csrss是系统关键进程
如果系统文件丢失的话可以用msconfig提取
rundll32
好像是在这里:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk\ShellNew]
"Command"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,72,\
00,75,00,6e,00,64,00,6c,00,6c,00,33,00,32,00,2e,00,65,00,78,00,65,00,20,00,\
61,00,70,00,70,00,77,00,69,00,7a,00,2e,00,63,00,70,00,6c,00,2c,00,4e,00,65,\
00,77,00,4c,00,69,00,6e,00,6b,00,48,00,65,00,72,00,65,00,20,00,25,00,31,00,\
00,00
其实就是这个字串了:%SystemRoot%\system32\rundll32.exe appwiz.cpl,NewLinkHere %1 |