用xdelbox删除以下文件
C:\WINDOWS\ddIEHelper.dll
C:\WINDOWS\system32\winlib .dll
C:\PROGRA~1\phob\cubo.dll
C:\PROGRA~1\phob\hzgt.dll
C:\WINDOWS\system32\WSockDrv32.dll
C:\WINDOWS\ddIEHelper.dll
C:\WINDOWS\system32\MsIMMs32.dll
C:\WINDOWS\system32\AVPSrv.dll
C:\WINDOWS\system32\upxdnd.dll
C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys
C:\WINDOWS\system32\tciocp32.dll
C:\WINDOWS\system32\xgnfn.dll
C:\WINDOWS\system32\hmsyiotwm.dll
C:\WINDOWS\system32\msccrt.dll
C:\WINDOWS\system32\DbgHlp32.dlL
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\ouydsojh.dll
C:\WINDOWS\system32\PTSShell.dll
C:\WINDOWS\system32\LotusHlp.dll
C:\WINDOWS\system32\SHAProc.dat
C:\WINDOWS\system32\ciovfkqdj.dll
C:\WINDOWS\system32\Kvsc3.dll
C:\WINDOWS\system32\pahzij.dll
C:\WINDOWS\system32\xfgnxfn.dll
C:\WINDOWS\system32\jwlah.dll
C:\WINDOWS\system32\duygnef.dll
C:\WINDOWS\system32\WINSvr32.dll
C:\WINDOWS\system32\zfdzb.dll
C:\WINDOWS\system32\hgfhk.dll
c:\windows\inf\pcidevices8.inf
c:\windows\inf\pciloader.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\vb6chs.dll
C:\WINDOWS\system32\lqxdlrwwow.dll
C:\WINDOWS\system32\HintServer.exe
C:\PROGRA~1\phob\zryl.dll
C:\PROGRA~1\phob\ewdq.dll
C:\PROGRA~1\phob\vnuh.dll
C:\WINDOWS\SYSTEM32\QOQ.EXE
C:\WINDOWS\system32\drivers\acpidisk.sys
C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp610.tmp
C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp5E2.tmp
C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp5D.tmp
C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp623.tmp
C:\WINDOWS\system32\drivers\MSPQM.sys
C:\WINDOWS\system32\drivers\msosfpids32.sys
C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp35.tmp
C:\WINDOWS\hwdjxhuc.exe
C:\WINDOWS\WSockDrv32.exe
C:\WINDOWS\MsIMMs32.exE
C:\WINDOWS\AVPSrv.exE
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\tciocp32.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\DbgHlp32.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\PTSShell.exe
C:\WINDOWS\LotusHlp.exe
C:\WINDOWS\SHAProc.exe
C:\WINDOWS\Kvsc3.exE
C:\WINDOWS\WINSvr32.exE
C:\WINDOWS\system32\msosiocp.dll
c:\windows\inf\pcidevices8.inf
C:\WINDOWS\system32\tcpip.exe
C:\WINDOWS\system32\HintServer.exe
C:\PROGRA~1\phob\zryl.dll
C:\WINDOWS\system32\windosqwpy.exe
C:\WINDOWS\system32\ksavp.exe
打开SREng-》启动项目->注册表->删除以下启动项目
<SoundMan><SOUNDMAN.EXE> [1]
<AtiPTA><atiptaxx.exe> [N/A]
<hhuwmdkj><C:\WINDOWS\hwdjxhuc.exe> []
<WSockDrv32><C:\WINDOWS\WSockDrv32.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exE> []
<AVPSrv><C:\WINDOWS\AVPSrv.exE> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<tciocp32><C:\WINDOWS\tciocp32.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<DbgHlp32><C:\WINDOWS\DbgHlp32.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<PTSShell><C:\WINDOWS\PTSShell.exe> []
<LotusHlp><C:\WINDOWS\LotusHlp.exe> []
<SHAProc><C:\WINDOWS\SHAProc.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exE> []
<WINSvr32><C:\WINDOWS\WINSvr32.exE> []
<{50632D5C-B71B-4ba0-B012-3DC6F15C011B}><C:\WINDOWS\system32\msosiocp.dll> [N/A]
<{D29DCEE0-457B-45A2-A92D-741B95B7723B}><C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys> []
<IFEO[ctfmon.exe]><SoundMan.exe> [1]
<IFEO[IceSword]><svchost.exe> [(Verified)Microsoft Windows Component Publisher]
<IFEO[ras]><svchost.exe> [(Verified)Microsoft Windows Publisher]
<IFEO[runiep]><svchost.exe> [(Verified)Microsoft Windows Publisher]
<IFEO[taskmgr.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
<AtiTrayTools><; > [N/A]
打开SREng-在"启动项目->服务->"Win32服务应用程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。 注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[DCOM Service Process Manager / DCOMManager][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->c:\windows\inf\pcidevices8.inf><Microsoft Corporation>
[portablemsi / portablemsi][Stopped/Disabled]
<C:\WINDOWS\system32\tcpip.exe><N/A>
[HintCAD Server / HintCADServer][Running/Auto Start]
<C:\WINDOWS\system32\HintServer.exe><N/A>
[umtg / umtg][Running/Auto Start]
<C:\WINDOWS\system32\rundll32.exe C:\PROGRA~1\phob\zryl.dll,Service -s><Microsoft Corporation>
[windosqwpy / windosqwpy][Stopped/Disabled]
<"C:\WINDOWS\system32\windosqwpy.exe" /service><N/A>
[Windows XP SP2 Center / Windows XP SP2 Center][Stopped/Disabled]
<C:\WINDOWS\system32\ksavp.exe><N/A>
打开SREng-在"启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。 注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>
[dohs / dohs][Stopped/Auto Start]
<\??\C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp610.tmp><N/A>
[drop / drop][Stopped/Auto Start]
<\??\C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp5E2.tmp><N/A>
[mhfp / mhfp][Stopped/Auto Start]
<\??\C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp5D.tmp><N/A>
[mnsf / mnsf][Stopped/Auto Start]
<\??\C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp623.tmp><N/A>
[Microsoft Streaming Quality Manager Proxy / MSPQM][Stopped/Manual Start]
<system32\drivers\MSPQM.sys><N/A>
[fpids32 / fpids32][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msosfpids32.sys><N/A>
[cqit / cqit][Stopped/Auto Start]
<\??\C:\DOCUME~1\LUOX~1.LUO\LOCALS~1\Temp\tmp35.tmp><N/A>
浏览器加载项
[]
{1D3E6D2D-ED58-43D2-9D17-98F584B14D3B} <C:\WINDOWS\ddIEHelper.dll, N/A>
[]
{D29DCEE0-457B-45A2-A92D-741B95B7723B} <C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys, N/A>
[]
{1D3E6D2D-ED58-43D2-9D17-98F584B14D3B} <C:\WINDOWS\ddIEHelper.dll, N/A>
[]
{D29DCEE0-457B-45A2-A92D-741B95B7723B} <C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys, N/A>
下载arswp(Windows清理助手)清理下
http://www.arswp.com/download/arswp/arswp.rar
还有问题再扫个日志上来
