一、日志中的问题如下：
==================================
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<><C:\WINDOWS\system32\dllcache\Default.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<><C:\WINDOWS\system\KEYBOARD.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<><C:\WINDOWS\system32\dllcache\Default.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<sys><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
<IFEO[auto.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe]
<IFEO[autorun.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]
<IFEO[autoruns.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe]
<IFEO[boot.exe]><C:\WINDOWS\Fonts\fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]
<IFEO[msconfig.exe]><C:\WINDOWS\Media\rndll32.pif> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessManager.exe]
<IFEO[ProcessManager.exe]><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]
<IFEO[procexp.exe]><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe]
<IFEO[rundll32.exe]><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
<IFEO[taskmgr.exe]><C:\WINDOWS\Fonts\tskmgr.exe> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []==================================
浏览器加载项
[SrchHook Class]
{F08555B0-9CC3-11D2-AA8E-000000000000} <C:\WINDOWS\system32\IEBHO.dll, >
[番茄工具条 3.0]
{6451F285-9E41-4D8C-813D-794CA7BFEAB4} <C:\WINDOWS\system32\IETool.dll, N/A>
[番茄工具条 3.0]
{6451F285-9E41-4D8C-813D-794CA7BFEAB4} <C:\WINDOWS\system32\IETool.dll, N/A>
[SrchHook Class]
{F08555B0-9CC3-11D2-AA8E-000000000000} <C:\WINDOWS\system32\IEBHO.dll, >
==================================
正在运行的进程
c:\windows\system32\uptool.dll
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe
C:\WINDOWS\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
==================================
Autorun.inf
[C:\]
[autorun]
Open=MS-DOS.com
Shellexecute=MS-DOS.com
Shell\Open\command=MS-DOS.com
Shell\Explore\command=MS-DOS.com
[D:\]
[autorun]
Open=MS-DOS.com
Shellexecute=MS-DOS.com
Shell\Open\command=MS-DOS.com
Shell\Explore\command=MS-DOS.com
[E:\]
[autorun]
Open=MS-DOS.com
Shellexecute=MS-DOS.com
Shell\Open\command=MS-DOS.com
Shell\Explore\command=MS-DOS.com
[F:\]
[autorun]
Open=MS-DOS.com
Shellexecute=MS-DOS.com
Shell\Open\command=MS-DOS.com
Shell\Explore\command=MS-DOS.com
==================================
进程特权扫描
特殊特权被允许： SeLoadDriverPrivilege [PID = 116, C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\GLOBAL.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 208, C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\SYSTEM.EXE]
特殊特权被允许： SeLoadDriverPrivilege [PID = 2016, C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\SVCHOST.EXE]
==================================
二、涉及病毒文件如下：
==================================
C:\WINDOWS\system\KEYBOARD.exe
C:\WINDOWS\system32\dllcache\Default.exe
C:\WINDOWS\system32\drivers\drivers.cab.exe
C:\WINDOWS\Media\rndll32.pif
C:\WINDOWS\Fonts\Fonts.exe
C:\WINDOWS\Fonts\tskmgr.exe
C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com
C:\windows\system32\uptool.dll
C:\WINDOWS\system32\IEBHO.dll
C:\WINDOWS\system32\IETool.dll
C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\GLOBAL.EXE
C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\SYSTEM.EXE
C:\WINDOWS\SYSTEM32\DLLCACHE\RECYCLER.{645FF040-5081-101B-9F08-00AA002F954E}\SVCHOST.EXE
C:\MS-DOS.com
C:\Autorun.inf
D:\MS-DOS.com
D:\Autorun.inf
E:\MS-DOS.com
E:\Autorun.inf
F:\MS-DOS.com
F:\Autorun.inf
=================================
三、建议：用冰刃解决。设置“禁止进线程创建”后，先删病毒文件，再删病毒创建的前述注册表项（注意红色注册表项将注册表值项的数据修改为空即可，不可删除值项本身）。
