我的电脑中了U病毒，sss.exe,我用杀毒软件把杀掉，双击D盘，E盘的时候，出现打开方式，急救

1 打开“我的电脑”，工具-文件夹选项，在d出的对话框的“查看”选项卡上，将“隐藏受保护的 *** 作系统文件（推荐）”前的勾去掉，并“显示所有文件和文件夹”，并将“隐藏已知文件类型的扩展名”前的勾去掉，确定。关闭“我的电脑”。

2 右键单击“我的电脑”，选“资源管理器”，在左侧窗口内单击“D盘”，在右侧窗口内将一个名为“autoruninf”的文件删除；同样将E盘的“autoruninf”的文件删除。

3 重启电脑。

OK？

如果无法显示隐藏文件的话，可在“WinRAR”软件下将“autoruninf”文件删除。

在下乡的时候，我就用当时用360安全卫士搞掂过类似的病毒，

当时是安全模式进不了，任何杀毒程序都运行不了，当时终止病毒程序后，把安全卫士改名，才能运行，一运行就把垃圾给清了下，终止程序等，用命令行把病毒给删除。

然后重启就正常了。今天这位校友把病毒样本上传上来了，我就用虚拟机把它中上，然后再手动搞它。实验得到的结果如下：个病毒在windows2003并不能很正常感染，但它的感染能力还是不错的。

关键会删除掉c:\windows\system32\verclsidexe这个文件。可能就是它的丢失才会那么容易死机。

0、这个丢失的文件最好在别的机器上复制个回来。

00、至于jhhmssrexe

和iwnaejeexe 的终止，不必用到别的程序，直接在任务管理器也可以关闭掉。

1、先把iwnaejeexe jhhmssrexe 的优先级降到最低。

再终止iwnaejeexe，d出窗口先不要那么快确定，等会再y。接着同样关掉jhhmssrexe。

2、还有个进程：avzxdstexe也用同样方法终止掉。

3、然后把各种修复工具改文件名，记住一定要改再运行，否则病毒又被激活，那就要多结束一次进程了。

4、这个系统应该会比较不稳定的了，它还修改了很多东西的。要手动修复也行。比较麻烦而已。5、这个病毒会释放出五种木马或插件程序。有:1珠仙盗号木马c:\windows\fonts\mszhaosdfon 2kafy盗号木马c:\windows\system32\avzxdmndll,avzxdstexe 3 秀宝桌面定向广告c:\windows\system32\serverexe 4pkeusvq:c:\progra~1\meexexe 5恶意程序servicesexe:c:\windows\system\servicesexe6、iwnaejeexe，jhhmssrexe ，diwlmoaexe等几个文件都隐藏到了c:\program files\common files\system 和c:\program files\common files\mirosoft shared files的目录里面了。所以要去除掉显示不出隐藏文件的，用这个注册表文件就可以回复隐藏文件的查看：＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝Windows Registry Editor Version 500[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced]

"TaskbarSizeMove"=dword:00000000

"TaskbarGlomming"=dword:00000000[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder]

"Type"="group"

"Text"="@shell32dll,-30498"

"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\

48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\

00

"HelpID"="shellhlp#51140"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ClassicViewState]

"Type"="checkbox"

"Text"="@shell32dll,-30506"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="ClassicViewState"

"CheckedValue"=dword:00000000

"UncheckedValue"=dword:00000001

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51076"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ControlPanelInMyComputer]

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\HideMyComputerIcons"

"Text"="@shell32dll,-30497"

"Type"="checkbox"

"ValueName"="{21EC2020-3AEA-1069-A2DD-08002B30309D}"

"CheckedValue"=dword:00000000

"UncheckedValue"=dword:00000001

"DefaultValue"=dword:00000001

"HKeyRoot"=dword:80000001

"HelpID"="shellhlp#51150"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\DesktopProcess]

"Type"="checkbox"

"Text"="@shell32dll,-30507"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="SeparateProcess"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51079"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\DesktopProcess\Policy][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\DesktopProcess\Policy\SeparateProcess]

@=""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\DisableThumbCache]

"Type"="checkbox"

"Text"="@shell32dll,-30517"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="DisableThumbnailCache"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51155"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\FolderSizeTip]

"Type"="checkbox"

"Text"="@shell32dll,-30514"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="FolderContentsInfoTip"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\FriendlyTree]

"Type"="checkbox"

"Text"="@shell32dll,-30511"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="FriendlyTree"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"HelpID"="shellhlp#51149"

"DefaultValue"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden]

"Text"="@shell32dll,-30499"

"Type"="group"

"Bitmap"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,74,\

00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,53,00,\

48,00,45,00,4c,00,4c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,34,00,00,\

00

"HelpID"="shellhlp#51131"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"Text"="@shell32dll,-30501"

"Type"="radio"

"CheckedValue"=dword:00000002

"ValueName"="Hidden"

"DefaultValue"=dword:00000002

"HKeyRoot"=dword:80000001

"HelpID"="shellhlp#51104"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"Text"="@shell32dll,-30500"

"Type"="radio"

"CheckedValue"=dword:00000001

"ValueName"="Hidden"

"DefaultValue"=dword:00000002

"HKeyRoot"=dword:80000001

"HelpID"="shellhlp#51105"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt]

"Type"="checkbox"

"Text"="@shell32dll,-30503"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="HideFileExt"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000001

"HelpID"="shellhlp#51101"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\NetCrawler]

"Type"="checkbox"

"Text"="@shell32dll,-30509"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="NoNetCrawling"

"CheckedValue"=dword:00000000

"UncheckedValue"=dword:00000001

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51147"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\NetCrawler\Policy][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\NetCrawler\Policy\NoNetCrawling]

@=""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\PersistBrowsers]

"Type"="checkbox"

"Text"="@shell32dll,-30513"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="PersistBrowsers"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"HelpID"="shellhlp#51152"

"DefaultValue"=dword:00000000[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ShowCompColor]

"Type"="checkbox"

"Text"="@shell32dll,-30512"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="ShowCompColor"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000001

"HelpID"="shellhlp#51130"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ShowFullPath]

"Type"="checkbox"

"Text"="@shell32dll,-30504"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CabinetState"

"ValueName"="FullPath"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51100"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ShowFullPathAddress]

"Type"="checkbox"

"Text"="@shell32dll,-30505"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CabinetState"

"ValueName"="FullPathAddress"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000001

"HelpID"="shellhlp#51107"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\ShowInfoTip]

"Type"="checkbox"

"Text"="@shell32dll,-30502"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="ShowInfoTip"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"DefaultValue"=dword:00000001

"HelpID"="shellhlp#51102"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SimpleSharing]

"Type"="checkbox"

"Text"="@shell32dll,-30518"

"HKeyRoot"=dword:80000002

"RegPath"="System\\CurrentControlSet\\Control\\LSA"

"ValueName"="ForceGuest"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"HelpID"="shellhlp#51154"

"DefaultValue"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden]

"Type"="checkbox"

"Text"="@shell32dll,-30508"

"WarningIfNotDefault"="@shell32dll,-28964"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="ShowSuperHidden"

"CheckedValue"=dword:00000000

"UncheckedValue"=dword:00000001

"DefaultValue"=dword:00000000

"HelpID"="shellhlp#51103"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]

@=""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Thickets]

"Text"="管理网页和文件夹对"

"HelpID"="TBD"

"Type"="group"

"Bitmap"="C:\\WINDOWS\\system32\\\\SHELL32DLL,4"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Thickets\AUTO]

"CheckedValue"=dword:00000000

"Type"="radio"

"ValueName"="NoFileFolderConnection"

"HelpID"="TBD"

"Text"="作为单一文件显示和管理对"

"DefaultValue"=dword:00000000

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"

"HKeyRoot"=dword:80000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Thickets\NOHIDE]

"ValueName"="NoFileFolderConnection"

"DefaultValue"=dword:00000000

"Text"="显示两部分但是作为单一文件进行管理"

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"

"HelpID"="TBD"

"Type"="radio"

"CheckedValue"=dword:00000002

"HKeyRoot"=dword:80000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Thickets\NONE]

"CheckedValue"=dword:00000001

"Type"="radio"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"

"HelpID"="TBD"

"ValueName"="NoFileFolderConnection"

"DefaultValue"=dword:00000000

"Text"="显示两部分并分别进行管理"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\WebViewBarricade]

"Type"="checkbox"

"Text"="@shell32dll,-30510"

"HKeyRoot"=dword:80000001

"RegPath"="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"

"ValueName"="WebViewBarricade"

"CheckedValue"=dword:00000001

"UncheckedValue"=dword:00000000

"HelpID"="shellhlp#51148"

"DefaultValue"=dword:00000000＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝上面的代码储存为showreg，双击导入，应该就可以找到它们了。360安全卫士里面可以看得到这些自启动文件，删除吧，里面所有的修复功能都搞下，否则重启又回来了。

uexe 是一个黑客后门病毒，uexe通过系统漏洞MS04-007、MS04-011、MS03-026、MS05-039感染。中毒的症状为倒计时，然后关机

uexe常伪装成norton的服务。这种病毒主要危害是连接IRC聊天服务器，接收黑客指令执行相应 *** 作，使用户被远程控制，沦为“肉鸡”；uexe 还会下载并执行其它病毒。中了uexe后在c:下面产生一个名为uexe的一个程序。进程中多了个 win32ssrexe的进程。

1、清除如下注册表键项

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Win32Sr”ImagePath” = “%windows%\win32ssrexe”

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetPT”ImagePath” = “%system%\drivers\netptsys”

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PerfFont”ImagePath” = “%system%\perfontexe”

HKEY_CLASSES_ROOT\CLSID\{4DE225BF-CF59-4CFC-85F7-68B90F185355}

2、1、下载 Xdelbox (最新版下载：>

以上就是关于我的电脑中了U病毒，sss.exe,我用杀毒软件把杀掉，双击D盘，E盘的时候，出现打开方式，急救全部的内容，包括:我的电脑中了U病毒，sss.exe,我用杀毒软件把杀掉，双击D盘，E盘的时候，出现打开方式，急救、怎么杀掉电脑上的U盘病毒diwlmoa.exe、U.exe 是什么东西 （在线等）等相关内容解答，如果想了解更多相关内容，可以关注我们，你们的支持是我们更新的动力！