==================================
正在运行的进程
[PID: 436][\SystemRoot\System32\smss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 500][\??\C:\WINDOWS\system32\csrss.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 524][\??\C:\WINDOWS\system32\winlogon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\WgaLogon.dll]  [Microsoft Corporation, 1.7.0018.5]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 568][C:\WINDOWS\system32\services.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 580][C:\WINDOWS\system32\lsass.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 728][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 772][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 876][C:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 968][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1044][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1236][C:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.2696 (xpsp_sp2_gdr.050610-1519)]
    [C:\WINDOWS\system32\CAP4LMK.DLL]  [CANON INC., 1.00.0.009]
    [C:\WINDOWS\system32\CAP4SMK.DLL]  [CANON INC., 1.00.0.009]
    [C:\WINDOWS\system32\CAP4PTN.DLL]  [CANON INC., 1.00.0.009]
[PID: 1360][C:\Program Files\ewido anti-spyware 4.0\guard.exe]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [C:\Program Files\ewido anti-spyware 4.0\engine.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
[PID: 1428][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1644][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
    [C:\Program Files\ewido anti-spyware 4.0\shellexecutehook.dll]  [Anti-Malware Development a.s., 4, 0, 0, 172]
    [C:\PROGRA~1\WINDOW~2\wmpband.dll]  [Microsoft Corporation, 10.00.00.3802]
    [C:\WINDOWS\system32\msacm32.drv]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.1.2003110300]
    [C:\Program Files\Microsoft Office\OFFICE11\msohev.dll]  [Microsoft Corporation, 11.0.5510]
[PID: 180][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 204][C:\WINDOWS\system32\WgaTray.exe]  [Microsoft Corporation, 1.7.0018.5]
[PID: 464][C:\Program Files\Common Files\Real\Update_OB\realsched.exe]  [RealNetworks, Inc., 0.1.0.3208]
[PID: 248][C:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.1.0.34]
[PID: 468][C:\WINDOWS\system32\wntbhaa.exe]  [N/A, ]
[PID: 544][C:\WINDOWS\system32\lgwubrw.exe]  [N/A, ]
[PID: 836][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 852][C:\Program Files\MSN Messenger\MsnMsgr.Exe]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\MSNCore.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msidcrl40.dll]  [Microsoft Corporation, 4.100.313.1]
    [C:\Program Files\MSN Messenger\ContactsUX.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msgslang.8.1.0178.00.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\msgsres.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\Program Files\MSN Messenger\custsat.dll]  [Microsoft Corporation, 9.0.3790.2428 (srv03_sp1_qfe.050422-1043)]
    [C:\Program Files\MSN Messenger\MSGSWCAM.dll]  [Microsoft Corporation, 8.1.0178.00]
    [C:\WINDOWS\system32\sirenacm.dll]  [Microsoft Corp., 8.1.0178.00]
    [C:\WINDOWS\system32\msdmo.dll]  [, ]
[PID: 1020][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 988][D:\♀应用&升级程序♀\arswp_PConline\arswp\ArSwp.exe]  [www.arswp.com, 1, 6, 6, 7]
    [D:\♀应用~1\ARSWP_~1\arswp\ArSwp.dll]  [www.arswp.com, 1, 7, 1, 7]
[PID: 1880][D:\♀应用&升级程序♀\sreng2\SREng1.EXE]  [Smallfrogs Studio, 2.4.12.806]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\system32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[AutoRun]
open=xdppvex.exe
shellexecute=xdppvex.exe
shell\Auto\command=xdppvex.exe
[E:\]
[AutoRun]
open=xdppvex.exe
shellexecute=xdppvex.exe
shell\Auto\command=xdppvex.exe
[F:\]
[AutoRun]
open=xdppvex.exe
shellexecute=xdppvex.exe
shell\Auto\command=xdppvex.exe

==================================
HOSTS 文件
127.0.0.1      localhost

==================================
API HOOK
N/A

==================================
隐藏进程
N/A

==================================


[/CODE]

是的．还真不少．除系统盘之外，其他盘也感染了。

哪位大侠帮帮忙啊！！

KAO 白打了一次..验证码错误

[PID: 468][C:\WINDOWS\system32\wntbhaa.exe] [N/A, ]
[PID: 544][C:\WINDOWS\system32\lgwubrw.exe] [N/A, ]用ICESWORD安全模式下删..
下个AUTORUN专杀..xdppvex.exe
非系统盘不要双击打开.
或者把下面语句保存为.bat文件来杀
attrib d:\xdppvex.exe -s -r -a -h
del d:\xdppvex.exe /f/s/a/q
attrib e:\xdppvex.exe -s -r -a -h
del e:\xdppvex.exe /f/s/a/q
attrib f:\xdppvex.exe -s -r -a -h
del f:\xdppvex.exe /f/s/a/q
attrib g:\xdppvex.exe -s -r -a -h
del g:\xdppvex.exe /f/s/a/q
attrib d:\autorun.inf -s -r -a -h
del d:\autorun.inf /f/s/a/q
attrib e:\autorun.inf -s -r -a -h
del e:\autorun.inf /f/s/a/q
attrib f:\autorun.inf -s -r -a -h
del f:\autorun.inf /f/s/a/q
attrib g:\autorun.inf -s -r -a -h
del g:\autorun.inf /f/s/a/q

安全模式下也打不开ICESWORD啊！！
哭~~~~

各位大虾，不全部格式化有没有办法啊？？

有，甭管它了 我发现我是中了 不过只是杀毒软件 和360打不开 别的没什么影响
呵呵
有就有吧！

那就用组策略....
gpedit.msc->用户配置->管理员什么来着.我英文版->系统->指定不运行的程序->启用并添加那2个.EXE文件和xdppvex.exe
在安全模式下,运行我的那个BAT..然后.重启

实在想捣鼓，就将你要用的工具放到Windows系统文件夹里，改名运行吧。