简直无奈了 连上网后打开IE自动连到C盘去了。。然后就一蓝屏 一堆英文 还经常自动跳出一些英文网页（一般是广告）时不时会出现一个对话框ipconfig.exe-应用程序错误 说什么该内存不能为“read”要终止程序 并且C盘也出现很多应用程序 删不掉。。。 下面是扫描的日志。。。看能不能修复阿~~~
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Rising\Rav\CCenter.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rising\Rav\Ravmond.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Rising\Rav\RavStub.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\bGw\command.exe
C:\Program Files\Network Monitor\netmon.exe
C:\WINDOWS\winlogon.exe
C:\WINDOWS\services.exe
C:\WINDOWS\system32\winscntrl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Rising\Rav\RavTask.exe
C:\dfndrd_4.exe
C:\Program Files\odyyghw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Rising\Rav\RavMon.exe
C:\Documents and Settings\fureya\桌面\HijackThis.exe

F2 - REG:system.ini: Shell=explorer.exe                                                                                                    "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe"
O3 - Toolbar: 电台(&R) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {FEDF637B-F631-4583-A210-33CC828D42DB} - (no file)
O3 - Toolbar: ToolBar888 - {CBCC61FA-0221-4ccc-B409-CEE865CACA3A} - C:\Program Files\ToolBar888\MyToolBar.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] ; "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] ; C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [IMSCMIG40W] C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMSC40W\IMSCMIG.EXE /SetPreload /Log
O4 - HKLM\..\Run: [BigDogPath] ; C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera
O4 - HKLM\..\Run: [RavTask] "C:\Program Files\Rising\Rav\RavTask.exe" -system
O4 - HKLM\..\Run: [StormCodec_Helper] ; "D:\Program Files\Storm Codec\StormSet.exe" /S /opti
O4 - HKLM\..\Run: [defender] C:\\dfndrd_4.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmd_4.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdd_4.exe
O4 - HKLM\..\Run: [zsk_MPH] C:\WINDOWS\System32\_zskwrkni04KVOGZ^Z_AXN\HPM_.exe
O4 - HKLM\..\Run: [SysTray] c:\Program Files\odyyghw.exe
O4 - HKLM\..\Run: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKLM\..\Run: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr_`.exe
O4 - HKLM\..\RunServices: [zsk_MPH] C:\WINDOWS\System32\_zskwrkni04KVOGZ^Z_AXN\HPM_.exe
O4 - HKLM\..\RunServices: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKLM\..\RunServices: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr_`.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKCU\..\Run: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr_`.exe
O8 - Extra context menu item: 上传到QQ网络硬盘 - D:\Program Files\T\AddToNetDisk.htm
O8 - Extra context menu item: 使用网际快车下载 - D:\Program Files\网际快车\jc_link.htm
O8 - Extra context menu item: 使用网际快车下载全部链接 - D:\Program Files\网际快车\jc_all.htm
O8 - Extra context menu item: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: 添加到QQ自定义面板 - D:\Program Files\T\AddPanel.htm
O8 - Extra context menu item: 添加到QQ表情 - D:\Program Files\T\AddEmotion.htm
O8 - Extra context menu item: 用QQ彩信发送该图片 - D:\Program Files\T\SendMMS.htm
O9 - Extra button: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: 相关站点 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\T\QQ.EXE
O9 - Extra 'Tools' menuitem: 腾讯QQ - {c95fe080-8f5d-11d2-a20b-00aa003c157b} - D:\Program Files\T\QQ.EXE
O9 - Extra button: (no name) - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\T\QQIEHelper.dll
O9 - Extra 'Tools' menuitem: QQ炫彩工具条设置 - {DEDEB80D-FA35-45d9-9460-4983E5A8AFE6} - D:\Program Files\T\QQIEHelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {F138084D-84D7-48CD-BEA8-04772457516E} (VqqSpeedDlProxy Class) - http://218.85.138.27/vqqsdl1009.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\lvl6093se.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\enpsl1771.dll (file missing)
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\mddxmlc.dll (file missing)
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\ducompos.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\bGw\command.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Rising Process Communication Center (RsCCenter) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\CCenter.exe
O23 - Service: RsRavMon Service (RsRavMon) - Beijing Rising Technology Co., Ltd. - C:\Program Files\Rising\Rav\Ravmond.exe
O23 - Service: Microsoft Windows Protection (Windows Protection Service) - Unknown owner - C:\WINDOWS\winlogon.exe
O23 - Service: Microsoft Windows Spooler Service (Windows Spooler Service) - Unknown owner - C:\WINDOWS\services.exe

开始→运行→输入services.msc，打开“服务”→查找 Command Service，Network Monitor，Microsoft Windows Protection，Microsoft Windows Spooler Service→双击→启动类型→禁止→停止→应用→确定。禁止Command Service，Network Monitor，Microsoft Windows Protection，Microsoft Windows Spooler Service这4个服务 （每一个逗号隔开的就是一个病毒的服务，请逐一禁用）
重启
ALT+CTRL+DELETE调出任务管理器,终止所有dfndrd_4.exe，odyyghw.exe，winscntrl.exe的进程
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""（
F2 - REG:system.ini: Shell=explorer.exe "C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrd_4.exe
O4 - HKLM\..\Run: [newname] C:\\nwnmd_4.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdd_4.exe
O4 - HKLM\..\Run: [zsk_MPH] C:\WINDOWS\System32\_zskwrkni04KVOGZ^Z_AXN\HPM_.exe
O4 - HKLM\..\Run: [SysTray] c:\Program Files\odyyghw.exe
O4 - HKLM\..\Run: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKLM\..\Run: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr_`.exe
O4 - HKLM\..\RunServices: [zsk_MPH] C:\WINDOWS\System32\_zskwrkni04KVOGZ^Z_AXN\HPM_.exe
O4 - HKLM\..\RunServices: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKLM\..\RunServices: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr
- HKCU\..\Run: [zsk^N]MJTNHPKWSKN] C:\WINDOWS\System32\_zskwrkni04C\NKSWKPHNTJM]N^.exe
O4 - HKCU\..\Run: [zsk`_rtklmaduytiyvg40inkrwksz_] c:\windows\system32\_zskwrkni04gvyityudamlktr_`.exe
O20 - Winlogon Notify: policies - C:\WINDOWS\system32\lvl6093se.dll
O20 - Winlogon Notify: Shell Extensions - C:\WINDOWS\
O20 - Winlogon Notify: SideBySide - C:\WINDOWS\system32\enpsl1771.dll (file missing)
O20 - Winlogon Notify: SMDEn - C:\WINDOWS\
O20 - Winlogon Notify: Uninstall - C:\WINDOWS\system32\mddxmlc.dll (file missing)
O20 - Winlogon Notify: WebCheck - C:\WINDOWS\system32\ducompos.dll (file
双击我的电脑，工具，文件夹选项，查看，单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示确定更改时，单击“是”，清除“隐藏已知文件类型的扩展名
删除
C:\WINDOWS\winlogon.exe
C:\WINDOWS\services.exe
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00007.exe
C:\\dfndrd_4.exe
C:\\nwnmd_4.exe
C:\\kybrdd_4.exe
C:\WINDOWS\System32\_zskwrkni04KVOGZ^Z_AXN\HPM_.exe
C:\WINDOWS\system32\lvl6093se.dll
C:\Program Files\Network Monitor

非常感谢。。但是偶启动电脑来看这个的时候捏个病毒好像又出现新的了。。。米办法。。。最后还是重装系统了。。。