引用:

【qianbai1的贴子】 没用，冰刃强删后重启又有 ………………

你把别的日志也发上来啊,服务,驱动,启动程序

安全模式下运行sreng删除启动项目:

<{131AB311-16F1-F13B-1E43-11A24B51AFD1}><C:\WINDOWS\system32\gdipri.dll> []
<{99F1D023-7CEB-4586-80F7-BB1A98DB7602}><C:\Program Files\Internet Explorer\IEXPLORE.Sys> [N/A]
<{FEB94F5A-69F3-4645-8C2B-9E71D270AF2E}><C:\Program Files\Internet Explorer\IEXPLORE.Dat> []
<{923509F1-45CB-4EC0-BDE0-1DED35B8FD60}><C:\Program Files\Internet Explorer\IEXPLORE.win> [N/A]
<{D14FA1E2-123F-6358-1E32-D2455234FDE2}><C:\WINDOWS\system32\nospri.dll> [N/A]
<{8A9B2F5D-1054-B457-64C4-85401918D02C}><C:\WINDOWS\system32\sovchot.DLL> []

删除启动项目--服务---WIN32应用程序
[Windows uoca RunThem / uoca][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mgxv\wthf.dll>< >
[WinWMService / WinWMService][Stopped/Auto Start]
<C:\WINDOWS\system32\RAVWM.EXE><N/A>
[WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
<C:\WINDOWS\TEMP\RAVWM.EXE><N/A>
[Automatic Updates / wuauserv][Running/Auto Start]
<C:\WINDOWS\system32\drivers\svchost.exe><N/A>

显示隐藏文件删除:

C:\WINDOWS\system32\gdipri.dll
C:\Program Files\Internet Explorer\IEXPLORE.Sys
C:\Program Files\Internet Explorer\IEXPLORE.Dat
C:\Program Files\Internet Explorer\IEXPLORE.win
C:\WINDOWS\system32\nospri.dll
C:\WINDOWS\system32\sovchot.DLL
C:\PROGRA~1\mgxv这个文件夹
C:\WINDOWS\system32\RAVWM.EXE
C:\WINDOWS\TEMP\RAVWM.EXE
C:\WINDOWS\system32\drivers\svchost.exe

<{131AB311-16F1-F13B-1E43-11A24B51AFD1}><C:\WINDOWS\system32\gdipri.dll> []
<{99F1D023-7CEB-4586-80F7-BB1A98DB7602}><C:\Program Files\Internet Explorer\IEXPLORE.Sys> [N/A]
<{FEB94F5A-69F3-4645-8C2B-9E71D270AF2E}><C:\Program Files\Internet Explorer\IEXPLORE.Dat> []
<{923509F1-45CB-4EC0-BDE0-1DED35B8FD60}><C:\Program Files\Internet Explorer\IEXPLORE.win> [N/A]
<{D14FA1E2-123F-6358-1E32-D2455234FDE2}><C:\WINDOWS\system32\nospri.dll> [N/A]
<{8A9B2F5D-1054-B457-64C4-85401918D02C}><C:\WINDOWS\system32\sovchot.DLL> []

[Windows uoca RunThem / uoca][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mgxv\wthf.dll>< >
[WinWMService / WinWMService][Stopped/Auto Start]
<C:\WINDOWS\system32\RAVWM.EXE><N/A>
[WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
<C:\WINDOWS\TEMP\RAVWM.EXE><N/A>
[Automatic Updates / wuauserv][Running/Auto Start]
<C:\WINDOWS\system32\drivers\svchost.exe><N/A>

用扫描日记这工具
删除服务
[Windows uoca RunThem / uoca][Stopped/Disabled]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\mgxv\wthf.dll>< >
[WinWMService / WinWMService][Stopped/Auto Start]
<C:\WINDOWS\system32\RAVWM.EXE><N/A>
[WinWMServiceNow / WinWMServiceNow][Stopped/Auto Start]
<C:\WINDOWS\TEMP\RAVWM.EXE><N/A>
删除驱动
[40531 / 40531][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\Drivers\40406.sys><Driver>
[ATSpy / ATSpy][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\ATSpy.sys><N/A>

用冰刃执行以下操作，最好改下冰刃的名，如：一窜数字.exe
文件-设置-禁止进程创建-确定
结束进程
PID: 1992][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2527 (xpsp.040919-1030)]
（看见空空的桌面别慌）
[PID: 2004][c:\program files\rising\rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
[PID: 512][C:\Program Files\Rising\AntiSpyware\runiep.exe] [B
[PID: 1404][C:\Program Files\Unlocker\UnlockerAssistant.exe]
[PID: 2676][C:\Documents and Settings\Administrator\桌面\新建文件夹\sreng2\SREng.EXE]

点注册表，然后删除注册表启动项
<{131AB311-16F1-F13B-1E43-11A24B51AFD1}><C:\WINDOWS\system32\gdipri.dll> []
<{99F1D023-7CEB-4586-80F7-BB1A98DB7602}><C:\Program Files\Internet Explorer\IEXPLORE.Sys> [N/A]
<{FEB94F5A-69F3-4645-8C2B-9E71D270AF2E}><C:\Program Files\Internet Explorer\IEXPLORE.Dat> []
<{923509F1-45CB-4EC0-BDE0-1DED35B8FD60}><C:\Program Files\Internet Explorer\IEXPLORE.win> [N/A]
<{D14FA1E2-123F-6358-1E32-D2455234FDE2}><C:\WINDOWS\system32\nospri.dll> [N/A]
<{8A9B2F5D-1054-B457-64C4-85401918D02C}><C:\WINDOWS\system32\sovchot.DLL> []
点文件，找到以上提到的文件（包括服务和驱动的），删除，别删错了，小心，看好名称和后缀！！

ps:然后取消冰刃的禁止进程创建，ctrl+alt+del,文件-新建任务，输入：explorer.exe,确定

看得太慢了，原来已经有两位高人回答了……不过那两个驱动真的没事吗？？楼主先别动这两个哦……

搞定，多谢楼上各位老大，这次长了不少学问

中午没删除驱动
[40531 / 40531][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\Drivers\40406.sys><Driver>
[ATSpy / ATSpy][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\ATSpy.sys><N/A>
刚刚开机它又阴魂不散来了，不过启动项目和服务项目比原来少了好几个，冰刃也没有发现有端口被打开，连两个驱动一起再删了，重启暂时没发现

subomaoming不错哦！！！！

刚开始还能坚持说所有的注意事项，


不知以后看得多了，会不会也象回了几千贴的，

不说多的了，只说注册项和文件，就算了。

引用:

【天月来了的贴子】subomaoming不错哦！！！！ 刚开始还能坚持说所有的注意事项， 不知以后看得多了，会不会也象回了几千贴的， 不说多的了，只说注册项和文件，就算了。 ………………

thanks!
语言表达还是不行……也不够严密，所以后边又有ps^-^郁闷呢 ，
不过我就是看得太慢，不过也是因为慢了点，看到了那两个驱动……呵呵
以后的事以后说吧，具体情况也具体处理，你这位高人还真的多点出手，好给我等晚辈学习学习……

开机一段时间后C:\WINDOWS\system32\drivers还是会生成这个svchost.exe，还有哪里没删干净呢？
[CODE]

2007-04-20,09:52:41

System Repair Engineer 2.4.12.806
Smallfrogs (http://www.KZTechs.com)

Windows XP Professional Service Pack 2 (Build 2600) - 管理权限用户 - 完整功能

以下内容被选中：
    所有的启动项目（包括注册表、启动文件夹、服务等）
    浏览器加载项
    正在运行的进程（包括进程模块信息）
    文件关联
    Winsock 提供者
    Autorun.inf
    HOSTS 文件


启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    <NvCplDaemon><; RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup>  [NVIDIA Corporation]
    <RavTask><"C:\Program Files\Rising\Rav\RavTask.exe" -system>  [Beijing Rising Technology Co., Ltd.]
    <RfwMain><"C:\Program Files\Rising\Rfw\rfwmain.exe" -Startup>  [Beijing Rising Technology Co., Ltd.]
    <runeip><C:\Program Files\Rising\AntiSpyware\runiep.exe>  [Beijing Rising Technology Co., Ltd.]
    <IMJPMIG8.1><; >  [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    <RavStub><"C:\Program Files\Rising\Rav\ravstub.exe" /RUNONCE>  [Beijing Rising Technology Co., Ltd.]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
    <shell><Explorer.exe>  [(Verified)Microsoft Windows XP Publisher]
    <Userinit><C:\WINDOWS\system32\userinit.exe,>  [(Verified)Microsoft Windows Publisher]
    <UIHost><logonui.exe>  [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><C:\WINDOWS\system32\RavExt.dll>  [Beijing Rising Technology Co., Ltd.]

==================================
启动文件夹
N/A

==================================
服务
[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
[NVIDIA Display Driver Service / NVSvc][Running/Auto Start]
  <C:\WINDOWS\system32\nvsvc32.exe><NVIDIA Corporation>
[Office Source Engine / ose][Stopped/Disabled]
  <"C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"><Microsoft Corporation>
[Rising Proxy  Service / RfwProxySrv][Running/Auto Start]
  <c:\program files\rising\rfw\rfwproxy.exe><Beijing Rising Technology Co., Ltd.>
[Rising Personal Firewall Service / RfwService][Running/Auto Start]
  <c:\program files\rising\rfw\rfwsrv.exe><Beijing Rising Technology Co., Ltd.>
[Rising Process Communication Center / RsCCenter][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\CCenter.exe"><Beijing Rising Technology Co., Ltd.>
[Rising RealTime Monitor / RsRavMon][Running/Auto Start]
  <"C:\Program Files\Rising\Rav\Ravmond.exe"><Beijing Rising Technology Co., Ltd.>
[StarWind iSCSI Service / StarWindService][Stopped/Disabled]
  <C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe><Rocket Division Software>

==================================
驱动程序
[AmdK8 Compatible Device / AmdK8][Stopped/Manual Start]
  <System32\drivers\amdk8.sys><Advanced Micro Devices>
[Rising TDI Base Driver / BaseTDI][Running/Auto Start]
  <System32\DRIVERS\BaseTDI.SYS><Beijing Rising Technology Co., Ltd.>
[ENTECH / ENTECH][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys><EnTech Taiwan>
[ExpScaner / ExpScaner][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\ExpScan.sys><>
[Microsoft UAA Bus Driver for High Definition Audio / HDAudBus][Running/Manual Start]
  <system32\DRIVERS\HDAudBus.sys><Windows (R) Server 2003 DDK provider>
[HookCont / HookCont][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HOOKCONT.sys><Rising>
[HookReg / HookReg][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookReg.sys><>
[HookSys / HookSys][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\HookSys.sys><Rising>
[HookUrl / HookUrl][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\HookUrl.sys><Beijing Rising Technology Co., Ltd.>
[ialm / ialm][Stopped/Manual Start]
  <system32\DRIVERS\ialmnt5.sys><Intel Corporation>
[Service for Realtek HD Audio (WDM) / IntcAzAudAddService][Running/Manual Start]
  <system32\drivers\RtkHDAud.sys><Realtek Semiconductor Corp.>
[MEMSCAN / MEMSCAN][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\MEMSCAN.sys><瑞星软件有限公司>
[mProcRs / mProcRs][Running/Auto Start]
  <\??\c:\program files\rising\rfw\mProcRs.sys><Beijing Rising Technology Co., Ltd.>
[npkcrypt / npkcrypt][Running/Auto Start]
  <\??\C:\Program Files\Tencent\QQ\npkcrypt.sys><INCA Internet Co., Ltd.>
[nv / nv][Running/Manual Start]
  <system32\DRIVERS\nv4_mini.sys><NVIDIA Corporation>
[Direct Parallel Link Driver / Ptilink][Running/Manual Start]
  <system32\DRIVERS\ptilink.sys><Parallel Technologies, Inc.>
[RsAntiSpyware / RsAntiSpyware][Running/Boot Start]
  <\SystemRoot\system32\drivers\RsBoot.sys><Beijing Rising>
[RsFwDrv / RsFwDrv][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rfw\RsFwDrv.sys><Beijing Rising Technology Co., Ltd.>
[RsNTGDI / RsNTGDI][Running/Boot Start]
  <\SystemRoot\system32\Drivers\RsNTGdi.sys><Beijing Rising Technology Co., Ltd.>
[RSPPSYS / RSPPSYS][Running/Auto Start]
  <\??\C:\Program Files\Rising\Rav\RSPPSYS.sys><Rising>
[Realtek 10/100/1000 PCI NIC Family NDIS XP Driver / RTL8023xp][Running/Manual Start]
  <system32\DRIVERS\Rtnicxp.sys><Realtek Semiconductor Corporation>
[Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver / rtl8139][Stopped/Manual Start]
  <system32\DRIVERS\RTL8139.SYS><Realtek Semiconductor Corporation>
[Secdrv / Secdrv][Running/Auto Start]
  <system32\DRIVERS\secdrv.sys><Macrovision Europe Ltd>
[sptd / sptd][Stopped/Boot Start]
  <\SystemRoot\System32\Drivers\sptd.sys><Duplex Secure Ltd.>
[VMware Pointing Device / vmmouse][Stopped/Manual Start]
  <system32\DRIVERS\vmmouse.sys><VMware, Inc.>