删除文件

D:\WINDOWS\hrrixr.exe]
D:\WINDOWS\anistio.exE
D:\WINDOWS\issms32.exe
D:\WINDOWS\dionpis.exe
D:\WINDOWS\fmbiost.exe
D:\WINDOWS\tciocp64.exe
D:\WINDOWS\mfchlp64.exe
D:\WINDOWS\huifitc.exe
D:\WINDOWS\ticisms.exe
D:\WINDOWS\system32\drivers\svchost.exe
D:\WINDOWS\wrew2ds.exe
D:\WINDOWS\wipxcdec.exe
D:\Program Files\Internet Explorer\PLUGINS\DosSys08.Sys
D:\WINDOWS\system32\MMKAFNFW1097.dll
D:\WINDOWS\system32\MMMHXGGD1061.dll
D:\WINDOWS\system32\mfdesy.dll
D:\WINDOWS\system32\MMBAIKOK1092.dll
D:\Documents and Settings\All Users\「开始」菜单\程序\启动\explorer.exe
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp1B.tmp
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp1F.tmp
D:\WINDOWS\system32\drivers\Hdv32_c.sys
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp1D.tmp
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp19.tmp
D:\DOCUME~1\gaolh\LOCALS~1\Temp\1.tmp
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp21.tm
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmp8.tmp
D:\DOCUME~1\gaolh\LOCALS~1\Temp\tmpA.tmp
D:\WINDOWS\system32\ukrth.dll
D:\WINDOWS\system32\hjmh.dll
D:\WINDOWS\system32\ghjkdr.dll
D:\WINDOWS\system32\dionpis.dll
D:\WINDOWS\system32\anistio.dll
D:\WINDOWS\system32\ytewcxzsw.dll
D:\WINDOWS\system32\issms32.dll
D:\WINDOWS\system32\fmsjhif.dll
D:\WINDOWS\system32\bincdwsa.dll
D:\WINDOWS\system32\dbhlp32.dlL
D:\WINDOWS\system32\fmsbbqi.dll
D:\WINDOWS\system32\ptshell.dll
D:\WINDOWS\system32\sfanouwz.dll
D:\WINDOWS\system32\hefcndy.dll
D:\WINDOWS\system32\tciocp64.dll
D:\WINDOWS\system32\huifitc.dll
D:\WINDOWS\system32\mfchlp64.dll
D:\WINDOWS\system32\ticisms.dll
D:\WINDOWS\system32\wipxcdec.dll
D:\WINDOWS\system32\wrew2ds.dll

建议删除用XDELBOX1.7 选择免生成

修复映像劫持

删除后重裝瑞星，全盘杀毒

开始－运行－regedit

删除
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<ytewcxzsw>
<anistio>
<issms32>
<dionpis>
<fmbiost>
<tciocp64>
<mfchlp64>
<ticisms>
<KVP>
<wrew2ds>
wipxcdec>

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs>

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}>
<{d6763cab-b46e-4f7f-8347-6f098a83a164}>
<{c064c122-504c-4793-a16c-2b061dd0c774}>
<{DC3D30AE-0380-4151-8934-EE98A34B0370}>
<{18e64250-19a8-4d10-828f-30e101a22291}>

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options 里面全部删除

因为系统盘在D盘

所以不能用XDELBOX删除病毒文件。

可以考虑用费尔木马清理助手：
http://dl.filseclab.com/down/powerrmv.zip

谨记谨记。。。

清理了病毒文件和注册表，瑞星小雨伞和盾牌又回来了，正在全盘杀毒，万分感谢：
天月来了、有毒必问、dibei 等的热心帮助！