上面是被挂钩函数

这个 C:\Windows\System32\Drivers\spkz.sys  每次重启电脑   文件名都会改变

该路径下也找不到相对应的驱动

C:\Windows\System32\drivers\etc

etc 文件夹也被改名了  改成了一串数字

spxx.sys不是病毒，是带毛兔子的sys，每次重启都会改掉自己名字的后两个字母。

我以前中过类似的, 用Linux cdrom/USB 开机可删.

176K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2K6K9h3&6S2i4K6u0W2j5$3!0E0i4K6u0W2j5$3&6Q4x3V1k6K6i4K6u0r3j5X3I4G2k6#2)9#2k6U0f1&6j5e0m8V1y4o6t1$3x3o6p5H3x3r3p5H3z5e0S2Q4x3X3g2Z5N6r3#2D9
一个小巧强大的Boot工具，无需BIOS支持实现U盘启动

2009 年 2 月写的:
推荐 PLoP Linux;
LiveCD, USB boot, PXE network boot, antivirus, rescue
4ffK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4m8D9L8%4m8Q4x3X3g2S2N6q4)9J5c8X3g2F1i4K6u0r3M7r3I4G2M7r3I4A6L8Y4g2^5i4K6u0W2K9s2c8E0L8l9`.`.

可以不用烧录 CD, 节省资源。

我之前是用 linux knoppix cdrom 开机:

输入 linux 2
(文字模式开机较快)

# cd /ramdisk
# fdisk -l

Disk /dev/sda: 164.6 GB, 164696555520 bytes
255 heads, 63 sectors/track, 20023 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes

   Device Boot Start End Blocks Id System
/dev/sda1 1 244 1959898+ 83 Linux
/dev/sda2 245 6324 48837600 83 Linux
/dev/sda3 6325 12404 48837600 83 Linux
/dev/sda4 12405 20023 61199617+ 83 Linux

System 是 HPFS/NTFS 或 FAT 的就是 windows.
我的 IBM notebook 是 /dev/hda1
而且 c:\i386 是 XP files.

所以
# cd /ramdisk
# mkdir /c
# mount /dev/hda1 /c
# wget 163K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3c8D9i4K6u0W2j5h3&6@1K9i4k6A6M7W2)9J5k6h3c8W2i4K6u0r3k6r3!0%4L8W2)9J5c8Y4k6V1k6W2)9J5c8Y4u0W2M7$3y4#2k6h3y4V1i4K6u0r3M7X3g2K6j5%4g2W2j5$3c8Q4x3X3g2A6M7$3)9`.
# mkdir /ramdisk/r
# mount rescuecd.iso /ramdisk/r -o loop,ro
# cd /ramdisk/r/antivir
# ./antivir >& /ramdisk/virlog01.txt
或#./antivir -s /c/WINDOWS >& /ramdisk/virlogwindows.log

# mkdir /c/virinfo
# mv /ramdisk/virlog01.txt /c/virinfo

# cd /c/WINDOWS/system32/drivers
# ls -la > /c/virinfo/dirdriversinlinux.txt

# mkdir /c/vir

<% 假设中了 9aaa.com IE 首页病毒
170K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0S2K9h3E0W2i4K6u0W2x3K6j5H3i4K6u0W2j5$3&6Q4x3V1j5@1x3o6t1@1x3o6x3%4i4K6u0r3x3e0R3&6x3e0f1$3x3K6g2Q4x3X3g2Z5N6r3#2D9i4K6y4r3M7r3q4Y4k6g2)9K6c8o6t1`.
%>

# mv /c/WINDOWS/system32/drivers/sarqlyku.sys /c/vir/

<% 看小红伞 scan log %>
# less -r /c/virinfo/virlog01.txt
# mv /c/WINDOWS/system32/xxxx /c/vir/

<%
linux 的 windows password/registry 工具
c86K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3S2G2L8h3g2Q4x3X3g2W2N6h3&6W2N6q4)9J5k6h3&6G2i4K6u0r3M7r3&6G2M7X3c8S2K9r3I4Q4x3V1k6F1N6s2m8S2M7%4y4%4k6q4)9J5c8X3y4Z5L8Y4c8H3N6#2)9J5k6s2y4G2N6i4u0U0k6g2)9J5k6o6l9^5x3o6f1J5y4W2)9J5k6i4A6A6M7l9`.`.
165K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3S2G2L8h3g2Q4x3X3g2W2N6h3&6W2N6q4)9J5k6h3&6G2i4K6u0r3M7r3&6G2M7X3c8S2K9r3I4Q4x3V1k6F1N6s2m8S2M7%4y4%4k6q4)9J5c8R3`.`.

备分 registry
mkdir /c/bak
cp -Ra /c/WINDOWS/system32/config /c/bak/
%>

<%
mscompress
cabextract
383K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3y4S2j5X3g2^5N6s2u0S2j5%4c8Q4x3X3g2G2M7X3N6Q4x3X3g2#2K9#2)9J5c8R3`.`.

XP cdrom 上有 I386 目录.
%>

# cd /ramdisk/
# cp /c/I386/SVCHOST.EX_ /ramdisk
# cabextract SVCHOST.EX_
  extracting svchost.exe
# md5sum svchost.exe
ccfc400f3305a61cbd8ad2a6f5671e4b svchost.exe

# md5sum /c/WINDOWS/system32/svchost.exe
ccfc400f3305a61cbd8ad2a6f5671e4b /c/WINDOWS/system32/svchost.exe

<% 6d0K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3k6A6L8r3g2Q4x3X3g2A6K9$3q4C8j5g2)9J5k6h3y4G2L8g2)9J5c8R3`.`. %>

带毛兔子是什么啊？

哦
是不是虚拟光驱？

为什么每次启动都要改变名字呢

Daemon Tools