[C:\Program Files\AutoCAD 2005\light8.dll]  [Autodesk, Inc., 8.1.63.0]
    [C:\Program Files\AutoCAD 2005\mtl8.dll]  [Autodesk, Inc., 8.1.63.0]
    [C:\Program Files\AutoCAD 2005\acgsimage.dll]  [Autodesk Inc., 16.1.63.0]
    [c:\program files\autocad 2005\drv\paint8.hdi]  [Autodesk, Inc., 8.1.63.0]
    [c:\program files\autocad 2005\drv\hlr8.hdi]  [Autodesk, Inc., 8.1.63.0]
    [C:\Program Files\AutoCAD 2005\ShareAC.dll]  [Autodesk, Inc, 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\drv\rblast8.hdi]  [Autodesk, Inc., 8.1.63.0]
    [C:\Program Files\AutoCAD 2005\acddptype.arx]  [Autodesk, Inc., 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\acddptypeRes.dll]  [Autodesk, Inc., 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\acmted.arx]  [Autodesk, 16.1.63.10]
    [C:\Program Files\AutoCAD 2005\AcMtedRes.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\MSCAND20.DLL]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Common Files\Microsoft Shared\IME\Shared2.0\IMEPADSM.DLL]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\AutoCAD 2005\AcRevcloud.arx]  [Autodesk, Inc., 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\AcRevcloudRes.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\AcMatch.arx]  [Autodesk, 16.1.63.0]
    [C:\Program Files\AutoCAD 2005\AcMatchRes.dll]  [Autodesk, 16.1.63.0]
[PID: 3372 / B21][C:\DOCUME~1\B21\LOCALS~1\Temp\AdskCleanup.0001]  [Macrovision Europe Ltd., 1, 0, 0, 1]
    [C:\WINDOWS\system32\IMJP9.IME]  [Microsoft Corporation, 9.0.5516.0]
    [C:\WINDOWS\system32\imjp9k.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3388 / SYSTEM][C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe]  [Autodesk, Inc., 2.51.000]
    [c:\program files\rising\rfw\ijt_base.dll]  [Beijing Rising Technology Co., Ltd., 7.0.0.9]
    [c:\program files\rising\rfw\olemon.dll]  [Beijing Rising Technology Co., Ltd., 7.0.0.4]
[PID: 3632 / B21][C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe]  [Autodesk, Inc., 1.2.0.1]
    [C:\Program Files\Common Files\Autodesk Shared\WebServices1.dll]  [Autodesk, Inc., 1.2.0.1]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 1776 / B21][C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\IMEPADSV.EXE]  [Microsoft Corporation, 9.0.5510.0]
    [c:\program files\rising\rfw\ijt_base.dll]  [Beijing Rising Technology Co., Ltd., 7.0.0.9]
    [c:\program files\rising\rfw\olemon.dll]  [Beijing Rising Technology Co., Ltd., 7.0.0.4]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\1041\imepadrs.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\WINDOWS\system32\IMJP9.IME]  [Microsoft Corporation, 9.0.5516.0]
    [C:\WINDOWS\system32\imjp9k.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\Shared2.0\imepadsm.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\MULTIBOX.DLL]  [Microsoft Corporation, 9.0.5510.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\IMSKF.DLL]  [Microsoft Corporation, 9.0.5510.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\SOFTKEY.DLL]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\Applets\PINTLMBX.DLL]  [Microsoft Corporation, 9.0.4924.0]
    [C:\Program Files\Common Files\Microsoft Shared\IME\IMSC40W\Applets\PINTLCSA.DLL]  [Microsoft Corporation, 9.0.4924.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\hwxjpn.dll]  [Microsoft Corporation, 2.0.1038.0]
    [C:\PROGRA~1\COMMON~1\MICROS~1\IME\IMJP9\APPLETS\imskdic.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Common Files\Microsoft Shared\Ink\hwxchs.dll]  [Microsoft Corporation, 1.0.0359.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
[PID: 3160 / B21][C:\WINDOWS\system32\taskmgr.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\IMJP9.IME]  [Microsoft Corporation, 9.0.5516.0]
    [C:\WINDOWS\system32\imjp9k.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.1.63.0]
    [C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN]  [Adobe Systems, Inc., 8.0.0.0]
[PID: 3716 / B21][D:\sreng2\SREngPS.EXE]  [Smallfrogs Studio, 2.5.16.900]
    [C:\WINDOWS\system32\IMJP9.IME]  [Microsoft Corporation, 9.0.5516.0]
    [C:\WINDOWS\system32\imjp9k.dll]  [Microsoft Corporation, 9.0.5510.0]
    [C:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 12]
    [D:\sreng2\Upload\3rdUpd.DLL]  [Smallfrogs Studio, 2, 1, 0, 15]

==================================
File Associations
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock Provider
N/A

==================================
Autorun.Inf
N/A

==================================
HOSTS File
127.0.0.1      localhost

==================================
Process Privileges Scan
Special Privilege Enabled: SeDebugPrivilege [PID = 3192, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3192, C:\PROGRAM FILES\RISING\ANTISPYWARE\RUNIEP.EXE]
Special Privilege Enabled: SeDebugPrivilege [PID = 3372, C:\DOCUME~1\B21\LOCALS~1\TEMP\ADSKCLEANUP.0001]
Special Privilege Enabled: SeLoadDriverPrivilege [PID = 3372, C:\DOCUME~1\B21\LOCALS~1\TEMP\ADSKCLEANUP.0001]

==================================
API HOOK
N/A

==================================
Hidden Process
N/A

==================================


[/CODE]

终于贴完了，自己看的都晕，就拜托各位高手了。多谢

顶一下自己

————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面各项，将启动类型改为“Disabled”
==================================
Drivers

[tdnal0 / tdnal0e][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\tdnal0e.sys><N/A>
[thsi4q9j / thsi4q9j][Running/Auto Start]
  <\??\C:\WINDOWS\system32\drivers\thsi4q9j.sys><N/A>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
Browser Add-ons

[]
  {16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
[Adobe PDF Conversion Toolbar Helper]
[]
  {16C6167B-FED4-4CEE-8951-134C9A345DA2} <C:\WINDOWS\system32\ffpomwcjsb.dll, >
————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本，全盘杀毒。

谢谢天月大大。
还有一个问题，请看顶楼

日志不对

我需要今天最新的日志。

打开注册表搜索“m6uowlk.dll”，注意全字匹配。

搜到的都备份一下后删除。

重新扫描了，请看顶楼，谢谢

你为什么偏要将日志发顶楼呢？？

记得你原来昨天的日志里没有C:\WINDOWS\system\1sass.exe和C:\WINDOWS\system32\winnet.sys的啊！
你才一天，又弄什么了呢？

你其他盘的文件被感染了吗？还是做了什么呢？

你只有用Xdelbox这个工具去删除这些文件。
Xdelbox下载：http://www.dodudou.com/down/里面的原创软件文件夹下载那个1.6版本的。
下载后
解压所有文件到一个文件夹,（一定要解压出来运行，不要懒）运行xdelbox前请卸载所有可移动存储设备。
将下面的文件信息全部复制，然后打开Xdelbox直接使用右键菜单的“剪贴板导入不检查路径”导入，并全选文件选择右键菜单的“立刻重启删除”

C:\WINDOWS\system\1sass.exe
C:\WINDOWS\System32\DRIVERS\tdnal0e.sys
C:\WINDOWS\system32\drivers\thsi4q9j.sys
C:\WINDOWS\system32\winnet.sys

重启计算机以后 会有两个系统进入的选择的倒计时界面
第一个是你原来的windows系统
第二个是这个软件给你设定的dos系统
系统会自动选择进入第二个系统
类似dos的界面滚动完毕以后 病毒就被删除了
之后会自动重启进入正常模式
进入系统后，再做下面的：
——————————————————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除
==================================
Services

[Rising Protected Storage / Risieg][Running/Auto Start]
  <C:\WINDOWS\system\1sass.exe><N/A>
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除
==================================
Drivers

[tdnal0 / tdnal0e][Running/Boot Start]
  <\SystemRoot\System32\DRIVERS\tdnal0e.sys><N/A>
[thsi4q9j / thsi4q9j][Stopped/Disabled]
  <\??\C:\WINDOWS\system32\drivers\thsi4q9j.sys><N/A>
[winnet / winnet][Running/Manual Start]
  <\??\C:\WINDOWS\system32\winnet.sys><N/A>
————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本全盘杀毒。

疯狂的晕，这是公司内其他员工的电脑。
马上照办。谢谢了。