启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <Internat.exe><; internat.exe>  [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  []
    <run><>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <Synchronization Manager><; mobsync.exe /logon>  [Microsoft Corporation]
    <AtiPTA><; Atiptaxx.exe>  [ATI Technologies, Inc.]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot>  [RealNetworks, Inc.]
    <RavTimer><; C:\Program Files\rising\rav\RavTimer.exe>  [rising]
    <RavMon><; C:\Program Files\rising\rav\RavMon.exe>  [rising]
    <RavService><; C:\Program Files\Rising\Rav\RavService.exe>  []
    <kpcdst><; C:\001\001\cdsprite.exe>  []
    <Super Rabbit Desktop Set><; C:\Program Files\Super Rabbit\MagicSet\DS.EXE /Load>  [Super Rabbit Software]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices]
    <RavMon><; C:\Program Files\rising\rav\RavMon.exe /AUTO>  [rising]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><explorer.exe>  [Microsoft Corporation]
    <Userinit><C:\WINNT\system32\userinit.exe,>  [Microsoft Corporation]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  []

==================================
启动文件夹
服务
[Ati HotKey Poller / Ati HotKey Poller]
  <C:\WINNT\System32\ati2plab.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
  <C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft    NetWork  FireWall  Services / Microsoft    NetWork  FireWall  Services]
  <Net_Services.exe><N/A>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services]
  <NetServices.exe><N/A>
[Rising Process Communication Center / RsCCenter]
  <C:\Program Files\Rising\Rav\CCenter.exe><rising>
[Rising Realtime Monitor Service / RsRavMon]
  <C:\Program Files\Rising\Rav\RavMonD.exe><rising>
[Smart Card Helper / SCardDrv]
  <C:\WINNT\system32\scardsvr32.exe -v><N/A>

==================================
浏览器加载项
[@shdoclc.dll,-866]
  {c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[电台(&R)]
  {8E718888-423F-11D2-876E-00A0C9082467} <C:\WINNT\system32\msdxm.ocx, Microsoft Corporation>
[Shockwave Flash Object]
  {D27CDB6E-AE6D-11CF-96B8-444553540000} <C:\WINNT\system32\macromed\flash\Flash.ocx, Macromedia, Inc.>

==================================
正在运行的进程
[PID: 160][\SystemRoot\System32\smss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 184][\??\C:\WINNT\system32\csrss.exe]  <Microsoft Corporation><5.00.2195.6601>
[PID: 180][\??\C:\WINNT\system32\winlogon.exe]  <Microsoft Corporation><5.00.2195.6970>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 232][C:\WINNT\system32\services.exe]  <Microsoft Corporation><5.00.2195.6700>
    [C:\WINNT\system32\dmserver.dll]  <VERITAS Software Corp.><2195.6605.297.3>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 244][C:\WINNT\system32\lsass.exe]  <Microsoft Corporation><5.00.2195.6902>
[PID: 412][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
[PID: 456][C:\WINNT\System32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 508][C:\WINNT\system32\spoolsv.exe]  <Microsoft Corporation><5.00.2195.6659>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 664][C:\WINNT\Explorer.EXE]  <Microsoft Corporation><5.00.3700.6690>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
    [C:\PROGRA~1\WINZIP\WZSHLSTB.DLL]  <WinZip Computing, Inc.><4.1 (32-bit)>
    [C:\PROGRA~1\WINZIP\wzshlex1.dll]  <WinZip Computing, Inc.><4.1 (32-bit)>
    [C:\PROGRA~1\WINZIP\WZCAB3.DLL]  <WinZip Computing, Inc.><3.1 (32-bit)>
    [C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL]  <N/A><N/A>
    [C:\Program Files\WinRAR\rarext.dll]  <N/A><N/A>
    [C:\WINNT\system32\RAVEXT.DLL]  <Beijing Rising Technology Co., Ltd.><16, 0, 0, 4>
[PID: 760][C:\Program Files\rising\rav\RavTimer.exe]  <rising><16, 0, 0, 23>
    [C:\Program Files\rising\rav\Language.dll]  <RiSing><15, 0, 0, 17>
    [C:\Program Files\rising\rav\RsCommX.dll]  <rising><15, 0, 1, 13>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 768][C:\Program Files\rising\rav\RavMon.exe]  <rising><16, 0, 0, 32>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
    [C:\Program Files\rising\rav\RavMon.dll]  <Beijing Rising Tech. Co. Ltd.><16, 0, 0, 63>
    [C:\Program Files\rising\rav\guidll.dll]  <rising><16, 0, 0, 36>
    [C:\Program Files\rising\rav\RsCommX.dll]  <rising><15, 0, 1, 13>
    [C:\Program Files\rising\rav\Language.dll]  <RiSing><15, 0, 0, 17>
[PID: 776][C:\Program Files\Super Rabbit\MagicSet\DS.EXE]  <Super Rabbit Software><1.50>
[PID: 676][C:\Program Files\Rising\Rav\CCenter.exe]  <rising><15, 0, 1, 8>
[PID: 796][C:\Program Files\Rising\Rav\RavMonD.exe]  <rising><16, 0, 0, 12>
    [C:\Program Files\Rising\Rav\RavMon.dll]  <Beijing Rising Tech. Co. Ltd.><16, 0, 0, 63>
    [C:\Program Files\Rising\Rav\guidll.dll]  <rising><16, 0, 0, 36>
    [C:\Program Files\Rising\Rav\RsCommX.dll]  <rising><15, 0, 1, 13>
    [C:\Program Files\Rising\Rav\Language.dll]  <RiSing><15, 0, 0, 17>
    [C:\Program Files\Rising\Rav\Engine.dll]  <rising><16, 0, 0, 56>
    [C:\Program Files\Rising\Rav\LibLoad.dll]  <Rising><16, 0, 0, 34>
    [C:\Program Files\Rising\Rav\StoreDll.dll]  <Beijing Rising Technology Co., Ltd.><16, 0, 0, 10>
    [C:\Program Files\Rising\Rav\ScanFile.dll]  <rising><16, 0, 0, 52>
    [C:\Program Files\Rising\Rav\NVFile.dll]  <rising><16, 0, 0, 4>
    [C:\Program Files\Rising\Rav\PostTrt.dll]  <Rising><16, 0, 0, 27>
    [C:\Program Files\Rising\Rav\PostTrtX.dll]  <瑞星科技股份有限公司><16, 0, 0, 10>
    [C:\Program Files\Rising\Rav\ExtFile.dll]  <RiSing><16, 0, 0, 28>
    [C:\Program Files\Rising\Rav\ExtMail.dll]  <rising><16, 0, 0, 31>
    [C:\Program Files\Rising\Rav\ScanEx.dll]  <rising><16, 0, 0, 62>
    [C:\Program Files\Rising\Rav\UnMacro.dll]  <rising><16, 0, 0, 10>
    [C:\Program Files\Rising\Rav\UnExe.dll]  <Rising><16, 0, 0, 36>
    [C:\Program Files\Rising\Rav\UnMail.dll]  <rising><16, 0, 0, 7>
    [C:\Program Files\Rising\Rav\BtEngine.dll]  <rising><16, 0, 0, 31>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\setup.dll]  <北京瑞星科技股份有限公司><14, 10, 0, 11>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
    [C:\Program Files\Rising\Rav\zip.dll]  <rising><13, 0, 0, 1>
    [C:\Program Files\Rising\Rav\VirusLib.dll]  <rs><16, 0, 0, 16>
[PID: 812][C:\WINNT\system32\MSTask.exe]  <Microsoft Corporation><4.71.2195.6920>
[PID: 856][C:\WINNT\System32\WBEM\WinMgmt.exe]  <Microsoft Corporation><1.50.1085.0100>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 876][C:\WINNT\system32\svchost.exe]  <Microsoft Corporation><5.00.2134.1>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 1188][C:\WINNT\system32\wuauclt.exe]  <Microsoft Corporation><5.8.0.2469 built by: lab01_n(wmbla)>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
[PID: 304][D:\009\SREng2\SREng.exe]  <Smallfrogs Studio><2.0.21.505>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
    [C:\Program Files\Rising\Rav\RavProxy.dll]  <rising><16, 0, 0, 6>
[PID: 316][C:\Program Files\rising\rav\RavService.exe]  <><16, 0, 0, 33>
    [C:\Program Files\Rising\Rav\ApiHook.dll]  <北京瑞星><16, 0, 0, 19>
    [C:\Program Files\Rising\Rav\MemMon.dll]  <北京瑞星><16, 2, 0, 6>
    [C:\Program Files\rising\rav\RsCommX.dll]  <rising><15, 0, 1, 13>
    [C:\Program Files\rising\rav\RavService936.dll]  <瑞星><16, 0, 0, 9>
    [C:\Program Files\Rising\Rav\RavProxy.dll]  <rising><16, 0, 0, 6>

文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINNT\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

删除
服务
[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINNT\System32\ati2plab.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services]
<Net_Services.exe><N/A>
[Microsoft NetWork FireWall Services / Microsoft NetWork FireWall Services]
<NetServices.exe><N/A>
[Smart Card Helper / SCardDrv]
<C:\WINNT\system32\scardsvr32.exe -v><N/A>

重启后删除（如果有的话）

C:\WINNT\system32\scardsvr32.exe
C:\WINNT\system32\SCARDSVR32.DLL
C:\WINNT\system32\MOFEI.CFG
Net_Services.exe
NetServices.exe

[exp1orer.exe]
CommandLine = "C:\WINNT\system32\exp1orer.exe"

[ServeHost.exe]
CommandLine = C:\WINNT\system32\ServeHost.exe

楼主若是不明白，试试以我的方法来解决
运行（双击打开）System Repair Engineer，点“启动项目，服务，点“Win32服务应用程序”勾选“隐藏微软服务”选中病毒服务Microsoft NetWork FireWall Services，Microsoft NetWork FireWall Services，Smart Card Helper选择“删除服务”点“设置”选择“否”最后重启。（每一个逗号隔开的就是一个病毒的服务，请逐一删除）
重启后删除
C:\WINNT\system32\scardsvr32.exe
Net_Services.exe
NetServices.exe以上两项可以搜索一下。

老师！为什么C:\WINNT\system32\scardsvr32.exe
Net_Services.exe
NetServices.exe都没找到呢？？

有一个C:\WINNT\system32\scardsvr.exe

不好意思，由于我的疏忽，
这两项服务是不用删除，对因此引起的麻烦，报以十二万分的歉意

[Ati HotKey Poller / Ati HotKey Poller]
<C:\WINNT\System32\ati2plab.exe><N/A>
[Logical Disk Manager Administrative Service / dmadmin]
<C:\WINNT\System32\dmadmin.exe /com><VERITAS Software Corp.>

是直接删吗