巧用“記事本” 讓病毒白白運行

<H2>巧用“記事本” 讓病毒白白運行</H2>
<DIV class=t_msgfont id=postmessage_17183995><SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%B5%E7%C4%D4"><NOBR><B class=kgb onmouseover='isShowAds = false;isShowAds2 = false;isShowGg = true;InTextAds_GgLayer="_u7535_u8111";KeyGate_ads.ShowGgAds(this,"_u7535_u8111",event)' style="BORDER-TOP-WIDTH: 0px; PADDING-RIGHT: 0px; PADDING-LEFT: 0px; FONT-WEIGHT: normal; BORDER-LEFT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; CURSOR: hand; COLOR: #ff8000; PADDING-TOP: 0px; BORDER-RIGHT-WIDTH: 0px; TEXT-DECORATION: underline" onclick='javascript:window.open("http://pagead2.googlesyndication.com/pagead/iclk?sa=l&amp;ai=Bsq43nuDESOzsD5LQvAO2yOWGCvOb4IUBi_fmsAnAjbcBwLgCEAEYASCsvJEKKBQ4AFDirObuAWCdwduBzAWyAQ9iYnMuMzY2dGlhbi5uZXTIAQHaAS1odHRwOi8vYmJzLjM2NnRpYW4ubmV0L3RocmVhZC04OTk1NDItMS0xLmh0bWzIAsWNowSoAwHoA7cE6APhBegDrwKIBAGQBAGYBAA&amp;num=1&amp;adurl=http://www.intel.com/cn/technology/architecture-silicon/index.htm%3Fcid%3Dprc:ggl%7Cchips_cn_gen%7Ck10147%7Cs&amp;client=ca-pub-1681215984289622");GgKwClickStat("電腦","www.intel.com","afc","2000072008");' onmouseout='isShowGg = false;InTextAds_GgLayer="_u7535_u8111"'>電腦</B></NOBR></SPAN>中毒后，許多朋友會打開“進程管理器”，將幾個不太熟悉的程序關閉掉，但有時會碰到這種情況：關掉一個，再去關閉另外一個時，剛才關閉的那個馬上又運行了。再從注冊表里先把啟動項刪除后，重啟試試，剛刪除的那些啟動項又還原了。<BR><BR>　　由于電腦只裝一個操作<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%CF%B5%CD%B3"><NOBR><B class=kgb onmouseover='isShowAds = false;isShowAds2 = false;isShowGg = true;InTextAds_GgLayer="_u7CFB_u7EDF";KeyGate_ads.ShowGgAds(this,"_u7CFB_u7EDF",event)' style="BORDER-TOP-WIDTH: 0px; PADDING-RIGHT: 0px; PADDING-LEFT: 0px; FONT-WEIGHT: normal; BORDER-LEFT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; CURSOR: hand; COLOR: #ff8000; PADDING-TOP: 0px; BORDER-RIGHT-WIDTH: 0px; TEXT-DECORATION: underline" onclick='javascript:window.open("http://pagead2.googlesyndication.com/pagead/iclk?sa=l&amp;ai=Bsq43nuDESOzsD5LQvAO2yOWGCvOb4IUBi_fmsAnAjbcBwLgCEAEYASCsvJEKKBQ4AFDirObuAWCdwduBzAWyAQ9iYnMuMzY2dGlhbi5uZXTIAQHaAS1odHRwOi8vYmJzLjM2NnRpYW4ubmV0L3RocmVhZC04OTk1NDItMS0xLmh0bWzIAsWNowSoAwHoA7cE6APhBegDrwKIBAGQBAGYBAA&amp;num=1&amp;adurl=http://www.intel.com/cn/technology/architecture-silicon/index.htm%3Fcid%3Dprc:ggl%7Cchips_cn_gen%7Ck10147%7Cs&amp;client=ca-pub-1681215984289622");GgKwClickStat("系統(tǒng)","www.intel.com","afc","2000072008");' onmouseout='isShowGg = false;InTextAds_GgLayer="_u7CFB_u7EDF"'>系統(tǒng)</B></NOBR></SPAN>，也沒辦法在另一個<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%CF%B5%CD%B3">系統(tǒng)</SPAN>下刪除這些<NOBR><B class=kgb onmouseover='isShowAds = false;isShowAds2 = false;isShowGg = true;InTextAds_GgLayer="_u75C5_u6BD2";KeyGate_ads.ShowGgAds(this,"_u75C5_u6BD2",event)' style="BORDER-TOP-WIDTH: 0px; PADDING-RIGHT: 0px; PADDING-LEFT: 0px; FONT-WEIGHT: normal; BORDER-LEFT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; CURSOR: hand; COLOR: #ff8000; PADDING-TOP: 0px; BORDER-RIGHT-WIDTH: 0px; TEXT-DECORATION: underline" onclick='javascript:window.open("http://pagead2.googlesyndication.com/pagead/iclk?sa=l&amp;ai=Bsq43nuDESOzsD5LQvAO2yOWGCvOb4IUBi_fmsAnAjbcBwLgCEAEYASCsvJEKKBQ4AFDirObuAWCdwduBzAWyAQ9iYnMuMzY2dGlhbi5uZXTIAQHaAS1odHRwOi8vYmJzLjM2NnRpYW4ubmV0L3RocmVhZC04OTk1NDItMS0xLmh0bWzIAsWNowSoAwHoA7cE6APhBegDrwKIBAGQBAGYBAA&amp;num=1&amp;adurl=http://www.intel.com/cn/technology/architecture-silicon/index.htm%3Fcid%3Dprc:ggl%7Cchips_cn_gen%7Ck10147%7Cs&amp;client=ca-pub-1681215984289622");GgKwClickStat("病毒","www.intel.com","afc","2000072008");' onmouseout='isShowGg = false;InTextAds_GgLayer="_u75C5_u6BD2"'>病毒</B></NOBR>。上網(wǎng)<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%CF%C2%D4%D8">下載</SPAN>專殺工具后，仍然不能殺掉。<BR><BR>　　如此翻來覆去，病毒未殺掉，人卻瀕臨崩潰。這時怎么辦呢?遇到這種情況，筆者向大家推薦一種方法。<BR><BR>　　第一步：在“開始→運行”中輸入CMD，打開“命令提示符”窗口。<BR><BR>　　第二步：輸入ftype exefile=notepad.exe %1，這句話的意思是將所有的EXE<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%CE%C4%BC%FE">文件</SPAN>用“記事本”打開。這樣原來的病毒就無法啟動了。<BR><BR>　　第三步：重啟電腦，你會看見打開了許多“記事本”。當然，這其中不僅有病毒文件，還有一些原來的系統(tǒng)文件，比如：輸入法程序。<BR><BR>　　第四步：右擊任何文件，選擇“打開方式”，然后點擊“瀏覽”，轉到<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=Windows">Windows</SPAN>System32下，選擇cmd.exe，這樣就可以再次打開“命令提示符”窗口。<BR><BR>　　第五步：運行ftype exefile=%1 %*，將所有的EXE文件關聯(lián)還原?，F(xiàn)在運行殺毒<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=%C8%ED%BC%FE">軟件</SPAN>或直接改回注冊表，就可以殺掉病毒了。<BR><BR>　　第六步：在每一個“記事本”中，點擊菜單中的“文件→另存為”，就可看到了路徑以及文件名了。找到病毒文件，手動刪除即可，但得小心，必須確定那是病毒才能刪除。建議將這些文件改名并記下，重啟后，如果沒有病毒作怪，也沒有系統(tǒng)問題，再進行刪除，<BR>附：Ftype的用法<BR>在Windows中，F(xiàn)type命令用來<NOBR><B class=kgb onmouseover='isShowAds = false;isShowAds2 = false;isShowGg = true;InTextAds_GgLayer="_u663E_u793A";KeyGate_ads.ShowGgAds(this,"_u663E_u793A",event)' style="BORDER-TOP-WIDTH: 0px; PADDING-RIGHT: 0px; PADDING-LEFT: 0px; FONT-WEIGHT: normal; BORDER-LEFT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; CURSOR: hand; COLOR: #ff8000; PADDING-TOP: 0px; BORDER-RIGHT-WIDTH: 0px; TEXT-DECORATION: underline" onclick='javascript:window.open("http://pagead2.googlesyndication.com/pagead/iclk?sa=l&amp;ai=BlYShnuDESOzsD5LQvAO2yOWGCpLvpmDUz-DmBsCNtwHAixEQAhgCIKy8kQooFDgAULf_uyNgncHbgcwFsgEPYmJzLjM2NnRpYW4ubmV0yAEB2gEtaHR0cDovL2Jicy4zNjZ0aWFuLm5ldC90aHJlYWQtODk5NTQyLTEtMS5odG1sqQK9whPkHaGDPsgCstGtBqgDAegDtwToA-EF6AOvAogEAZAEAZgEAA&amp;num=2&amp;adurl=http://www.konzesys.com&amp;client=ca-pub-1681215984289622");GgKwClickStat("顯示","www.konzesys.com","afc","2000072008");' onmouseout='isShowGg = false;InTextAds_GgLayer="_u663E_u793A"'>顯示</B></NOBR>及<NOBR><B class=kgb onmouseover='isShowAds = false;isShowAds2 = false;isShowGg = true;InTextAds_GgLayer="_u4FEE_u6539";KeyGate_ads.ShowGgAds(this,"_u4FEE_u6539",event)' style="BORDER-TOP-WIDTH: 0px; PADDING-RIGHT: 0px; PADDING-LEFT: 0px; FONT-WEIGHT: normal; BORDER-LEFT-WIDTH: 0px; BORDER-BOTTOM-WIDTH: 0px; PADDING-BOTTOM: 0px; MARGIN: 0px; CURSOR: hand; COLOR: #ff8000; PADDING-TOP: 0px; BORDER-RIGHT-WIDTH: 0px; TEXT-DECORATION: underline" onclick='javascript:window.open("http://pagead2.googlesyndication.com/pagead/iclk?sa=l&amp;ai=B5-Z6nuDESOzsD5LQvAO2yOWGCpXI-XTXqK_7B8CNtwGQsAoQAxgDIKy8kQooFDgAUOP2sOoDYJ3B24HMBbIBD2Jicy4zNjZ0aWFuLm5ldMgBAdoBLWh0dHA6Ly9iYnMuMzY2dGlhbi5uZXQvdGhyZWFkLTg5OTU0Mi0xLTEuaHRtbKkCvcIT5B2hgz7IAvWT9AWoAwHoA7cE6APhBegDrwKIBAGQBAGYBAA&amp;num=3&amp;adurl=http://www.hiseate.net/index.htm%3FActiveNode%3D1&amp;client=ca-pub-1681215984289622");GgKwClickStat("修改","www.hiseate.net/index.htm?ActiveNod","afc","2000072008");' onmouseout='isShowGg = false;InTextAds_GgLayer="_u4FEE_u6539"'>修改</B></NOBR>不同擴展名文件所關聯(lián)的打開程序。相當于在注冊表編輯器中修改“H<SPAN class=t_tag onclick=tagshow(event) href="tag.php?name=KEY">KEY</SPAN>_CLASSES_ROOT”項下的部分內容一樣。<BR>Ftype的基本使用格式為：Ftype [文件類型[=[打開方式/程序]]]<BR>比如：像上例中的ftype exefile=notepad.exe %1，表示將所有文件類型為EXE(exefile表示為EXE類型文件)的文件都通過“記事本”程序打開，后面的%1表示要打開的程序本身(就是雙擊時的那個程序)。<BR>ftype exefile=%1 %*則表示所有EXE文件本身直接運行(EXE 可以直接運行，所以用表示程序本身的%1即可)，后面的%*則表示程序命令后帶的所有參數(shù)(這就是為什么EXE文件可以帶參數(shù)運行的原因)。</DIV>