呵呵!病毒全在启动项

运行"SREng.exe"后定位到:

启动项目--注册表


删除:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

<NMGameX_AutoRun><C:\WINDOWS\System32\Rundll32.exe NMGameX.dll,LiveProcess /aa> [NMGameX]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]

<AlxInit><C:\WINDOWS\system32\AlxUp.exe> []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]

<AppInit_DLLs><APIHookDll.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

<{86F4BDA2-C04B-4662-953A-9A47C1F10C5C}><C:\WINDOWS\System32\Cq.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]

<DVDBurn><C:\WINDOWS\Downloaded Program Files\AfxEdit.dll> []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

<默认><; http://www.Emode.CN> []

==================================
服务

[Computer Storage / DATEING]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\IRJIT.DLL,Export 1087><N/A>



再清理下流氓

http://www.pctutu.com

建议你用Ad-Aware SE查一下

http://forum.ikaka.com/topic.asp?board=67&artid=7247932

再修复下文件关联

谢谢高人,这就去试试.

惨不忍睹，千疮百孔，集流氓病毒木马于一机！

重装系统或恢复ghost备份！

建议你还是重新安装系统吧，系统已经不干净了，就是把病毒杀了，它还是有僵尸在里面啊，目前还没有那个杀毒软件能杀毒还能清理病毒僵尸的？这好比一碗汤里掉进了一颗老鼠屎，就是你已经把它捞出来了，但是这碗汤你还能喝得下去吗？

<MsnMsgr><"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background> [Microsoft Corporation]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<IMJPMIG8.1><C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32> [Microsoft Corporation]
<PHIME2002ASync><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC> [Microsoft Corporation]
<PHIME2002A><C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName> [Microsoft Corporation]

WeatherOnTray><C:\Program Files\Hotbar\bin\4.5.1.0\WeatherOnTray.exe> [TODO: <Company name>]
<NMGameX_AutoRun><C:\WINDOWS\System32\Rundll32.exe NMGameX.dll,LiveProcess /aa> [NMGameX]
<Hotbar><C:\Program Files\Hotbar\bin\4.5.1.0\HbInst.exe /Upgrade> []
<TkBellExe><"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<popo2004><> []
<MINI_BFYY><C:\Program Files\Ringz Studio\Storm Downloader\StormDownloader.exe> [深圳市三代科技开发有限公司]

<WangWang><"G:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE"> [淘宝（中国）软件有限公司]
<mscfs><RUNDLL32 C:\WINDOWS\System32\msibm\cfsys.dll,cfs> []
<InfoReceiver><H:\电脑报2005合订本赠送光盘@猪猪乐园@五月初二\电脑报合订本2005\InfoReceiver\InfoReceiver.exe> []
<NeroFilterCheck><C:\WINDOWS\system32\NeroCheck.exe> [Ahead Software Gmbh]
<YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe> [ ]
<StormCodec_Helper><"C:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti> []
<Thunder><"C:\Program Files\Thunder Network\Thunder\ThunderShell.exe" /s> []
<yassistse><"C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe"> [Yahoo!]
<ThunderMini><C:\Program Files\Thunder Network\ThunderMini\ThunderMiniShell.exe> []
以上删除，不是流氓就是垃圾软件！

<spoolsv><C:\WINDOWS\System32\spoolsv\spoolsv.exe -printer> []
木马病毒!

DVDBurn><C:\WINDOWS\Downloaded Program Files\AfxEdit.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<默认><; http://www.Emode.CN> []
Microsoft Office]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Microsoft Office.lnk><N>
[Acrobat Assistant]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\Acrobat Assistant.lnk><N>
[腾讯TM]
<C:\Documents and Settings\admin\「开始」菜单\程序\启动\腾讯TM.lnk><N>
删除，没用！

[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>

C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 0, 4, 1030>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
[C:\PROGRA~1\Yahoo!\ASSIST~1\assist\ywiper.dll] <N/A><1, 0, 1, 1014>

C:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll] <Windows (R) 2000 DDK provider><5.00.2195.1620>

[PID: 1904][G:\Program Files\淘宝网\淘宝旺旺\WangWang.EXE] <淘宝（中国）软件有限公司><1, 5, 5, 1226>
[G:\Program Files\淘宝网\淘宝旺旺\AliViewCtrl.dll] <vline><1, 0, 0, 1>
[G:\Program Files\淘宝网\淘宝旺旺\VLNetwork.dll] <><1, 0, 0, 6>
[G:\Program Files\淘宝网\淘宝旺旺\AliViewMedia.dll] <vline><1, 0, 0, 1>
[G:\Program Files\淘宝网\淘宝旺旺\VideoCAP.dll] <><1, 0, 0, 4>
[G:\Program Files\淘宝网\淘宝旺旺\VLAudio.dll] <><1, 0, 0, 4>
[G:\Program Files\淘宝网\淘宝旺旺\JsmShow.dll] <><1, 0, 0, 3>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>
[G:\Program Files\淘宝网\淘宝旺旺\Ali_Res.DLL] <N/A><N/A>
[G:\Program Files\淘宝网\淘宝旺旺\RichOne.dll] <淘宝(中国)软件有限公司><1.0.0.1>

C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>

[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>
[PID: 1944][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe] < ><2, 0, 0, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 0, 4, 1030>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
[C:\PROGRA~1\Yahoo!\ASSIST~1\ynotifier.dll] <><1, 0, 0, 5>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\yasfsks.dll] <3721.com><2, 1, 1, 87>
[PID: 2040][C:\PROGRA~1\Yahoo!\Assistant\yassistse.exe] <Yahoo!><1, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yMenuInfo.dll] <Yahoo><1, 0, 0, 2>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yIEAngel.dll] <Yahoo><1, 0, 1, 1001>
[C:\PROGRA~1\Yahoo!\Assistant\shell\yAsMenu.dll] <Yahoo><1, 0, 1, 1006>

C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll] <><2, 0, 1, 1018>
[C:\PROGRA~1\Yahoo!\ASSIST~1\yscrblock.dll] <Yahoo><1, 0, 2, 1002>
[C:\PROGRA~1\Yahoo!\ASSIST~1\YAlive.dll] <><2, 0, 4, 1030>
[C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll] < ><2, 0, 1, 1007>
删除！不是流氓就是恶意软件！

---------------------------
以上意见只代表个人意见！

自己考虑！