瑞杀出Backdoor.Gpigeon.vqx这个病毒，重起又有了,杀了又来.烦!
高手help!!!!!!!!

去下载sreng2,关闭qq，下载软件等一切不必要的程序后扫个日志上来，一次贴不完分段贴，不要修改
http://www.kztechs.com/sreng/sreng2.zip

鸽子,先试试金山的专杀,杀不掉再扫SRENG日志上来

扫描个报告来!

[CODE]

2007-04-17,14:11:21

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <load><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <SunJavaUpdateSched><C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe>  [Sun Microsystems, Inc.]
    <NvCplDaemon><RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <NvMediaCenter><RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <YLive.exe><C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe>  [(Verified)"beijing yahoo consulting and service co., ltd."]
    <RavTask><"d:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <MSConfig><C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><>  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <0m9b7><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe>  [N/A]
    <26tkmydh><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe>  [N/A]
    <7ce31jshcqgml><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <BigDogPath><; C:\WINDOWS\VM_STI.EXE USB PC Camera 301P>  [N/A]
    <cmdbcs><; C:\WINDOWS\cmdbcs.exe>  []
    <DAEMON Tools><; "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033>  [(Verified)DAEMON Tools Code Signing Services]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <f190b><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <fdbcs><; C:\WINDOWS\aasdf3.exe>  [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    <Load><; ?粓??>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <mppds><; C:\WINDOWS\aasdf2.exe>  [N/A]
    <nwiz><; nwiz.exe /install>  [NVIDIA Corporation]
    <nwizms><; C:\WINDOWS\system32\nwizms.exe>  []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <ravshell><; C:\WINDOWS\SVCH0ST.exe>  [N/A]
    <ravshelll><; C:\Progra~1\Eset\eexplore.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <runeip><; D:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <shualai><; C:\WINDOWS\shualai.exe /i>  [N/A]
    <SoundMan><; SOUNDMAN.EXE>  [(Verified)Microsoft Windows Hardware Compatibility Publisher]
    <StormCodec_Helper><; "d:\Program Files\Ringz Studio\Storm Codec\StormSet.exe" /S /opti>  []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <svc><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spolive.exe>  [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot>  [RealNetworks, Inc.]
    <upsxdnd><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upsxdnd.exe>  [N/A]
    <upxdnd><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIMPLATF0RM.exe>  []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <w0><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <winform><; C:\WINDOWS\aasdf1.exe>  [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    <y9><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe>  [N/A]

正在运行的进程
[PID: 632][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 712][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 744][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 788][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 800][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 948][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1028][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1164][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\program files\iesnap\navoct.dll]  [ , 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
[PID: 1204][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 668][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 6, 7, 1122]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 2, 1011]
    [C:\Program Files\WinRAR\rarext.dll]  [N/A, ]
    [d:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\WINDOWS\system32\nvcpl.dll]  [NVIDIA Corporation, 6.14.10.6182]
    [C:\WINDOWS\system32\NVRSZHC.DLL]  [NVIDIA Corporation, 6.14.10.6182]
    [C:\WINDOWS\system32\nvshell.dll]  [NVIDIA Corporation, 6.14.10.6182]
    [C:\Program Files\Yahoo!\Assistant\Assist\yphtb.dll]  [Yahoo! China, 3, 0, 8, 1010]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\YDRAGS~1.DLL]  [yahoo! china, 3, 0, 6, 1008]
    [C:\Program Files\Yahoo!\Assistant\Assist\yflashdl.dll]  [Yahoo! China, 3, 0, 1, 1013]
    [C:\Program Files\Yahoo!\Assistant\Assist\yassist.dll]  [Yahoo! China, 3, 1, 8, 1023]
    [D:\Program Files\Microsoft Office\Office10\msohev.dll]  [Microsoft Corporation, 10.0.2609]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Assist\ywiper.dll]  [Yahoo! China, 3, 0, 5, 1009]
    [D:\Program Files\Tencent\QQ\qdshm.dll]  [, 1, 0, 101, 20]
    [D:\Program Files\Tencent\QQ\MFC42.DLL]  [Microsoft Corporation, 6.00.8665.0]
[PID: 1936][C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe]  [Sun Microsystems, Inc., 5.0.40.5]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
[PID: 2024][C:\PROGRA~1\Yahoo!\ASSIST~1\YLive.exe]  [Yahoo! China, 3, 2, 2, 1028]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 6, 7, 1122]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 2, 1011]
    [C:\Program Files\Yahoo!\Assistant\yNotifier.dll]  [yahoo! china, 3, 0, 2, 1002]
[PID: 320][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
[PID: 2516][c:\PROGRA~1\iesnap\navplay.exe]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\Documents and Settings\Administrator\桌面\DubaTool_Huigezi.COM]  [, 2007, 3, 20, 21]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 692][C:\Program Files\Tencent\TT\TTraveler.exe]  [腾讯公司, 3.2.200.275]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\yaLive.dll]  [yahoo! china, 3, 6, 7, 1122]
    [C:\Program Files\Tencent\TT\Plugins\QQFloatBar\QQFloatBar4TT2.dll]  [腾讯公司, 1, 1, 0, 5]
    [C:\Program Files\Tencent\TT\Plugins\TWeather\TWeather.dll]  [, 1, 0, 0, 3]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yalliveex.dll]  [Yahoo! China, 3, 0, 2, 1011]
    [c:\PROGRA~1\iesnap\navpref.dll]  [, 1, 0, 1, 1]
    [C:\Program Files\Tencent\TT\dbghelp.dll]  [Microsoft Corporation, 6.3.0005.1 (DbgBuild.030922-1449)]
    [c:\PROGRA~1\iesnap\navseg.dll]  [, 1, 0, 1, 1]
    [c:\PROGRA~1\iesnap\navneg.dll]  [, 1, 0, 1, 1]
    [C:\Program Files\Tencent\TT\PersonalDesktop.dll]  [深圳市腾讯计算机系统公司QQ工作小组, 1, 0, 0, 4]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\WINDOWS\system32\UNISPIM.IME]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
    [C:\WINDOWS\system32\upengine.dll]  [北京清华紫光软件股份有限公司, 3.0.0.3045]
[PID: 2392][D:\Program Files\Rising\Rav\RsAgent.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 12]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [D:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
[PID: 580][C:\WINDOWS\msagent\AgentSvr.exe]  [Microsoft Corporation, 2.00.0.3422]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2160][F:\sreng2\SREng.EXE]  [Smallfrogs Studio, 2.4.12.806]
    [C:\PROGRA~1\Yahoo!\ASSIST~1\Yhelper.dll]  [Yahoo! China, 3, 0, 8, 1026]
    [c:\PROGRA~1\iesnap\navstub.dll]  [, 1, 0, 1, 1]
    [C:\PROGRA~1\wtby\jgrl.dll]  [, 1, 0, 0, 6]
    [C:\PROGRA~1\wtby\olwq.dll]  [ , 1, 0, 0, 6]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

引用:

【饭后点心的贴子】鸽子,先试试金山的专杀,杀不掉再扫SRENG日志上来 ………………

不行,杀不了

日志不全，也不要补了，重做系统去吧……

你好像对个个都是这样说的

注册表
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<0m9b7><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe> [N/A]
<26tkmydh><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> [N/A]
<7ce31jshcqgml><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []

<cmdbcs><; C:\WINDOWS\cmdbcs.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<f190b><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<fdbcs><; C:\WINDOWS\aasdf3.exe> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
<Load><; ?粓??> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<mppds><; C:\WINDOWS\aasdf2.exe> [N/A]
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<ravshell><; C:\WINDOWS\SVCH0ST.exe> [N/A]
<ravshelll><; C:\Progra~1\Eset\eexplore.exe> [N/A]
<shualai><; C:\WINDOWS\shualai.exe /i> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<svc><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spolive.exe> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<svc><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spolive.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<TkBellExe><; "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot> [RealNetworks, Inc.]
<upsxdnd><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\upsxdnd.exe> [N/A]
<upxdnd><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\TIMPLATF0RM.exe> []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<w0><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<winform><; C:\WINDOWS\aasdf1.exe> [N/A]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
<y9><; C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe> [N/A]

把各个项对应的EXE DLL文件删除