只要打开d盘，病毒就会在c盘根目录生成一个test.exe文件（注绝对不是vista.exe那个病毒），只在c盘根目录生成这个文件，而且只生成test.exe没有别的文件，别的盘没有。
我自己装的nod32查不到，用了卡巴和瑞星的在线查毒也查不到。。。别人用咖啡也杀不到。。。。。。。

[用户系统信息]Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 2.0.50727; MAXTHON 2.0)

http://www.kztechs.com/index1.html
下载System Repair Engineer 2.5
扫描日志上来

SREng分析文件

日志文件 Trend Micro HijackThis v 2.0.2
日志保存时间: 19:17:55,2008-2-20
操作系统: Windows 2000 SP4 (WinNT 5.00.2195)
IE版本: Internet Explorer v6.00 SP1 (6.00.2800.1106)
启动模式: 正常

正在运行的进程:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\Ati2evxx.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINNT\system32\drivers\CDAC11BA.EXE
C:\Program Files\cFosSpeed\spd.exe
C:\Program Files\Hellonet5.01\hnserv.exe
D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\cFosSpeed\cFosSpeed.exe
C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINNT\tsnp325.exe
C:\WINNT\vsnp325.exe
C:\WINNT\system32\internat.exe
C:\WINNT\au30tray.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\stisvc.exe
D:\Program Files\Maxthon\Maxthon.exe
C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe
D:\download\hijackthis.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\nsu2E.tmp\hijackthis.exe

O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: (未命名) - {D032570A-5F63-4812-A094-87D007C23012} - C:\PROGRA~1\Maxthon\Plugin\topbho\IEBHO.dll
O4 - HKLM\..\Run: [VortexTray] C:\WINNT\au30setp.exe 3
O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\CA\eTrust Internet Security Suite\eTrust Personal Firewall\ca.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [tsnp325] C:\WINNT\tsnp325.exe
O4 - HKLM\..\Run: [snp325] C:\WINNT\vsnp325.exe
O4 - HKLM\..\Run: [FixCamera] ; C:\WINNT\FixCamera.exe
O4 - HKLM\..\Run: [Grid Service] ; "C:\Program Files\GridService\peer.exe" -n Grid
O4 - HKLM\..\Run: [NetpasAcc] ; C:\Program Files\UASIT\bapima_netpas\Netpas_Acc.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] ; C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [StartCCC] ;"C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [ulcdsrv] ; C:\WINNT\system32\ulcdsrv.exe
O4 - HKLM\..\Run: [WangWang] ; "C:\Program Files\Alisoft\WangWang\WangWang.EXE"
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [AtiTrayTools] "C:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"
O4 - HKCU\..\Run: [MsnMsgr] ; "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\.DEFAULT\..\Run: [Internat.exe] internat.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Intec Service Drivers] C:\WINNT\system32\wing32.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - 扩展右键菜单项: &V使用Vagaa哇嘎下载 - D:\Vagaa\Data\vg.htm
O8 - 扩展右键菜单项: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - 扩展右键菜单项: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - 扩展右键菜单项: 导出到 Microsoft Office Excel(&X) - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - 扩展右键菜单项: 用维棠下载视频 - C:\Program Files\ViDown\vd_link.htm
O9 - 额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 额外的“工具”菜单项目: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 额外的按钮: 浩方对战平台 - {0A155D3C-68E2-4215-A47A-E800A446447A} - D:\Program Files\HFGameOPT\GameClient.exe
O9 - 额外的按钮: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - D:\Program Files\PPLive TV\PPLive.exe
O9 - 额外的“工具”菜单项目: PPLive - {95B3F550-91C4-4627-BCC4-521288C52977} - D:\Program Files\PPLive TV\PPLive.exe
O9 - 额外的按钮: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - 额外的“工具”菜单项目: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O10 - Unknown file in Winsock LSP: c:\winnt\system32\gamelink.dll
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com.cn/webscanner/kavwebscan_unicode.cab
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.com/download/1101/aliedit.cab
O16 - DPF: {2375BEE5-F175-4F1C-81EC-8E4E2E72E2DD} (PhotoDraw Class) - http://imgcache.qq.com/qzone/client/photo/pages/QQPhotoDrawSetup.exe
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {ECCBA953-80E5-11D3-9285-0080ADB811C5} (safeInput Class) - https://pbank.95559.com.cn/netpay/ocx/safe.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E3A68B59-A02E-4F58-875A-1DF1C128E387}: NameServer = 192.168.1.1
O23 - NT 服务:  Ati HotKey Poller - ATI Technologies Inc. - C:\WINNT\system32\Ati2evxx.exe
O23 - NT 服务:  Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - NT 服务:  C-DillaCdaC11BA - Macrovision - C:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - NT 服务:  cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe
O23 - NT 服务:  Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - NT 服务:  Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - NT 服务:  HelloNet PPPoE Service (HelloNet_PPPoE_Service) - Unknown owner - C:\Program Files\Hellonet5.01\hnserv.exe
O23 - NT 服务:  InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - NT 服务:  RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - D:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe
O23 - NT 服务:  NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset\nod32krn.exe
O23 - NT 服务:  ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - NT 服务:  Utility Manager (UtilMan) - Unknown owner - C:\WINNT\System32\UtilMan.exe(文件不存在)
O23 - NT 服务:  TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe

--
文件结束 - 7534 字节         

断开网络1.建议使用XDelBox删除以下文件http://www.dodudou.com/down/index.php](XDelBox1.6下载)
使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择勾上抑制再生，从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。


c:\winnt\system32\raqjbpi.dll
c:\winnt\system32\rarjbpi.dll

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：

[{24783410-4F90-34A0-7820-3230ACD05F42}]    <C:\WINNT\system32\raqjbpi.dll>
[{2598FF45-DA60-F48A-BC43-10AC47853D52}]    <C:\WINNT\system32\rarjbpi.dll>

test只有一家报