请帮忙！

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; QQDownload 1.7)
如果上传附件后就可以解决吗？

System.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\814662
c:\windows\System32\Drivers\aliimz.sys
C:\WINDOWS\system32\f35ee9e.sys
c:\windows\system32\drivers\HBKernel32.sys
C:\WINDOWS\system32\de8296f.sys
C:\WINDOWS\system32\b160485.sys
C:\Program Files\Internet Explorer\53u1ttMe.2ys
C:\WINDOWS\system32\csrss.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh01019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh02004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh03003.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh05004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh12007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh14016.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh15011.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh17019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh18022.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh21015.dll]  [N/A, ]
  [C:\WINDOWS\system32\sh23007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh27006.dll]  [N/A, ]
[C:\WINDOWS\system32\Lj602lm.dll]  [N/A, ]
  [C:\WINDOWS\system32\122B901E.dll]  [N/A, ]
    [C:\WINDOWS\system32\C8FFD223.dll]  [N/A, ]
    [C:\WINDOWS\system32\9F684DE8.dll]  [N/A, ]
    [C:\WINDOWS\system32\4FBFD5A4.dll]  [N/A, ]
    [C:\WINDOWS\system32\BA7EDF54.dll]  [N/A, ]
    [C:\WINDOWS\system32\DA63E650.dll]  [N/A, ]
    [C:\WINDOWS\system32\58FF3024.dll]  [N/A, ]
    [C:\WINDOWS\system32\E4814792.dll]  [N/A, ]
    [C:\WINDOWS\system32\66AFCB56.dll]  [N/A, ]
    [C:\WINDOWS\system32\08223B03.dll]  [N/A, ]
    [C:\WINDOWS\system32\201476D0.dll]  [N/A, ]
    [C:\WINDOWS\system32\5934EA2B.dll]  [N/A, ]
    [C:\WINDOWS\system32\2EF0D734.dll]  [N/A, ]
    [C:\WINDOWS\system32\E1D19FCC.dll]  [N/A, ]
    [C:\WINDOWS\system32\A1A6BC2E.dll]  [N/A, ]
    [C:\WINDOWS\system32\F8E07BB2.dll]  [N/A, ]
    [C:\WINDOWS\system32\34A25F04.dll]  [N/A, ]
    [C:\WINDOWS\system32\56BC86C7.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh01019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh02004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh03003.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh05004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh12007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh14016.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh15011.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh17019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh18022.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh21015.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh23007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh27006.dll]  [N/A, ]
[C:\WINDOWS\system32\HBQQSG.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBQQXX.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBWD.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBJTLQ.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBDNF.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBmhly.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBTL.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBWOW.dll]  [N/A, ]
d:\e1027.exe
d:\Autorun.inf
C:\DOCUME~1\ADMINI~1\LOCALS~1\TEMP\814662]
提交到这里，或者提交给瑞星，地址如下：http://mailcenter.rising.com.cn/index.shtml

注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<HBService32><System.exe>  []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
    <nwiz><cmhot.exe>  []
    <svt234><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\865441>  [File is missing]
    <svt2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\814662>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><122B901E.dll>  []
    <{C8FFD223-C0FB-40C5-94A0-FD7891AC18E9}><C8FFD223.dll>  []
    <{9F684DE8-3E87-4174-9033-E02A3DFD8B61}><9F684DE8.dll>  []
    <{43ACDCC5-9009-4AF4-B80A-93BC656EF298}><43ACDCC5.dll>  [N/A]
    <{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}><4FBFD5A4.dll>  []
    <{BA7EDF54-8408-4B21-B351-7B447B344BA4}><BA7EDF54.dll>  []
    <{DA63E650-537C-4042-87BB-9D19D844680B}><DA63E650.dll>  []
    <{F65BDEC7-4BF3-4512-840F-68B166B6D7AC}><F65BDEC7.dll>  [N/A]
    <{58FF3024-8A83-4B1A-88E9-302F47646EEE}><58FF3024.dll>  []
    <{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><E4814792.dll>  []
    <{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}><66AFCB56.dll>  []
    <{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><08223B03.dll>  []
    <{9CA963CA-107C-4089-B0AB-31380F90D7E3}><9CA963CA.dll>  [N/A]
    <{5B77087D-AB76-4C22-B0A6-C34D1F438E55}><C:\Program Files\Common Files\Microsoft Shared\MSInfo\Come_System.sys>  [File is missing]
    <{201476D0-2B18-462E-AB9F-3E2B0CC8732B}><201476D0.dll>  []
    <{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}><5934EA2B.dll>  []
    <{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><2EF0D734.dll>  []
    <{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}><E1D19FCC.dll>  []
    <{755D0ED0-3996-4ADB-9B1F-AD8F0E9E4738}><755D0ED0.dll>  [File is missing]
    <{F6A454AE-156A-415E-9F89-3795677A8A91}><C:\Program Files\Internet Explorer\53u1ttMe.2ys>  [File is missing]
    <{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}><A1A6BC2E.dll>  []
    <{F8E07BB2-7A19-4057-80F1-E14646E630B4}><F8E07BB2.dll>  []
    <{34A25F04-008D-403E-8EE6-2307BC02FA2E}><34A25F04.dll>  []
    <{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}><56BC86C7.dll>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe]
    <IFEO[Thunder5.exe]><svchost.exe>  [(Verified)Microsoft Windows Publisher]

[Human Interface Device Access / HidServ][Stopped/Disabled]
  <C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\System32\hidserv.dll><N/A>
驱动程序
[aliimz / aliimz][Stopped/Manual Start]
  <System32\Drivers\aliimz.sys><N/A>
[f35ee9e / f35ee9e][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\f35ee9e.sys><N/A>
[HBKernel32 Driver / HBKernel32][Stopped/Boot Start]
  <\SystemRoot\system32\drivers\HBKernel32.sys><N/A>
[oreans32 / oreans32][Running/System Start]
  <\??\C:\WINDOWS\system32\drivers\oreans32.sys><N/A>
[anti qqsg / antisg][Running/Disabled]
  <\??\C:\Documents and Settings\Administrator\antisg.sys><N/A>
[de8296f / de8296f][Stopped/Manual Start]
  <\??\C:\WINDOWS\system32\de8296f.sys><N/A>
[b160485 / b160485][Running/Manual Start]
  <\??\C:\WINDOWS\system32\b160485.sys><N/A>
浏览器加载项
[]
  {F6A454AE-156A-415E-9F89-3795677A8A91} <C:\Program Files\Internet Explorer\53u1ttMe.2ys, N/A>
[]
  {F6A454AE-156A-415E-9F89-3795677A8A91} <C:\Program Files\Internet Explorer\53u1ttMe.2ys, N/A>
运行的进程
    [C:\WINDOWS\system32\122B901E.dll]  [N/A, ]
    [C:\WINDOWS\system32\C8FFD223.dll]  [N/A, ]
    [C:\WINDOWS\system32\9F684DE8.dll]  [N/A, ]
    [C:\WINDOWS\system32\4FBFD5A4.dll]  [N/A, ]
    [C:\WINDOWS\system32\BA7EDF54.dll]  [N/A, ]
    [C:\WINDOWS\system32\DA63E650.dll]  [N/A, ]
    [C:\WINDOWS\system32\58FF3024.dll]  [N/A, ]
    [C:\WINDOWS\system32\E4814792.dll]  [N/A, ]
    [C:\WINDOWS\system32\66AFCB56.dll]  [N/A, ]
    [C:\WINDOWS\system32\08223B03.dll]  [N/A, ]
    [C:\WINDOWS\system32\201476D0.dll]  [N/A, ]
    [C:\WINDOWS\system32\5934EA2B.dll]  [N/A, ]
    [C:\WINDOWS\system32\2EF0D734.dll]  [N/A, ]
    [C:\WINDOWS\system32\E1D19FCC.dll]  [N/A, ]
    [C:\WINDOWS\system32\A1A6BC2E.dll]  [N/A, ]
    [C:\WINDOWS\system32\F8E07BB2.dll]  [N/A, ]
    [C:\WINDOWS\system32\34A25F04.dll]  [N/A, ]
    [C:\WINDOWS\system32\56BC86C7.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh01019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh02004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh03003.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh05004.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh12007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh14016.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh15011.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh17019.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh18022.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh21015.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh23007.dll]  [N/A, ]
    [C:\WINDOWS\system32\sh27006.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBQQSG.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBQQXX.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBWD.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBJTLQ.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBDNF.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBmhly.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBTL.dll]  [N/A, ]
    [C:\WINDOWS\system32\HBWOW.dll]  [N/A, ]
Autorun.inf
D:\  Autorun.inf  e1027.exe 
E:\  Autorun.inf  e1027.exe
F:\  Autorun.inf  e1027.exe



[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
    <AppInit_DLLs><HBmhly.dll,HBWOW.dll,HBDNF.dll,HBQQSG.dll,HBQQXX.dll,HBWD.dll,HBJTLQ.dll,HBTL.dll>  []  此启动项值清空<AppInit_DLLs><>  []

参见
http://bbs.ikaka.com/showtopic-8565484.aspx

先下载这个
xpsp2系统的相关文件替换程序：

附件: XPSP2系统下的文件替换程序.rar (2008-11-20 17:13:49, 211.79 K)


运行后
替换成功后

1.建议使用XDelBox删除以下文件： Xdelbox1.8下载地址
使用说明：先勾选抑制再生，删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除(不论文件是否存在，继续操作重启删除
)，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。



C:\autorun.inf
D:\autorun.inf
E:\autorun.inf
F:\autorun.inf
C:\e1027.exe
D:\e1027.exe
F:\e1027.exe
E:\e1027.exe
c:\docume~1\admini~1\locals~1\temp\814662
c:\docume~1\admini~1\locals~1\temp\753080
c:\windows\system32\system.exe
c:\windows\system32\lj602lm.dll
c:\windows\system32\08223b03.dll
c:\windows\system32\122b901e.dll
c:\windows\system32\201476d0.dll
c:\windows\system32\2ef0d734.dll
c:\windows\system32\34a25f04.dll
c:\windows\system32\4fbfd5a4.dll
c:\windows\system32\56bc86c7.dll
c:\windows\system32\5934ea2b.dll
c:\windows\system32\58ff3024.dll
c:\windows\system32\66afcb56.dll
c:\windows\system32\9f684de8.dll
c:\windows\system32\a1a6bc2e.dll
c:\windows\system32\ba7edf54.dll
c:\windows\system32\c8ffd223.dll
c:\windows\system32\da63e650.dll
c:\windows\system32\e1d19fcc.dll
c:\windows\system32\e4814792.dll
c:\windows\system32\f8e07bb2.dll
c:\windows\system32\hbjtlq.dll
c:\windows\system32\hbdnf.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\hbqqsg.dll
c:\windows\system32\hbqqxx.dll
c:\windows\system32\hbtl.dll
c:\windows\system32\hbwd.dll
c:\windows\system32\hbwow.dll
c:\program files\internet explorer\58u1ntme.2ys
c:\program files\tencent\qq\psapi.dll
c:\windows\system32\sh01019.dll
c:\windows\system32\sh02004.dll
c:\windows\system32\sh03003.dll
c:\windows\system32\sh05004.dll
c:\windows\system32\sh12007.dll
c:\windows\system32\sh14016.dll
c:\windows\system32\sh15011.dll
c:\windows\system32\sh18022.dll
c:\windows\system32\sh21015.dll
c:\windows\system32\sh23007.dll
c:\windows\system32\sh27006.dll
c:\docume~1\admini~1\locals~1\temp\865441
c:\program files\common files\microsoft shared\msinfo\come_system.sys
c:\program files\internet explorer\53u1ttme.2ys
c:\windows\system32\drivers\aliimz.sys
c:\windows\system32\b160485.sys
c:\windows\system32\de8296f.sys
c:\documents and settings\administrator\antisg.sys
c:\windows\system32\drivers\hbkernel32.sys
c:\windows\system32\f35ee9e.sys

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}]    <56BC86C7.dll>
[{34A25F04-008D-403E-8EE6-2307BC02FA2E}]    <34A25F04.dll>
[{F8E07BB2-7A19-4057-80F1-E14646E630B4}]    <F8E07BB2.dll>
[{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}]    <A1A6BC2E.dll>
[{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}]    <E1D19FCC.dll>
[{2EF0D734-21FD-4225-A1A2-BCD296182AAF}]    <2EF0D734.dll>
[{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}]    <5934EA2B.dll>
[{201476D0-2B18-462E-AB9F-3E2B0CC8732B}]    <201476D0.dll>
[{9CA963CA-107C-4089-B0AB-31380F90D7E3}]    <9CA963CA.dll>
[{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}]    <08223B03.dll>
[{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}]    <66AFCB56.dll>
[{E4814792-EFA3-4C20-93D0-8B130A59F9A8}]    <E4814792.dll>
[{58FF3024-8A83-4B1A-88E9-302F47646EEE}]    <58FF3024.dll>
[{F65BDEC7-4BF3-4512-840F-68B166B6D7AC}]    <F65BDEC7.dll>
[{DA63E650-537C-4042-87BB-9D19D844680B}]    <DA63E650.dll>
[{BA7EDF54-8408-4B21-B351-7B447B344BA4}]    <BA7EDF54.dll>
[{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}]    <4FBFD5A4.dll>
[{43ACDCC5-9009-4AF4-B80A-93BC656EF298}]    <43ACDCC5.dll>
[{9F684DE8-3E87-4174-9033-E02A3DFD8B61}]    <9F684DE8.dll>
[{C8FFD223-C0FB-40C5-94A0-FD7891AC18E9}]    <C8FFD223.dll>
[{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}]    <122B901E.dll>
注意该项[AppInit_DLLs]修改：把<HBmhly.dll,HBWOW.dll,HBDNF.dll,HBQQSG.dll,HBQQXX.dll,HBWD.dll,HBJTLQ.dll,HBTL.dll>修改为<>即清空
[svt2]    <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\814662>
[nwiz]    <cmhot.exe>
[HBService32]    <System.exe>
[svt234]    <C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\865441>
[{5B77087D-AB76-4C22-B0A6-C34D1F438E55}]    <C:\Program Files\Common Files\Microsoft Shared\MSInfo\Come_System.sys>
[{F6A454AE-156A-415E-9F89-3795677A8A91}]    <C:\Program Files\Internet Explorer\53u1ttMe.2ys>

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
(选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否NO"才是确认删除服务）


[aliimz / aliimz]    <System32\Drivers\aliimz.sys>
[b160485 / b160485]    <\??\C:\WINDOWS\system32\b160485.sys>
[de8296f / de8296f]    <\??\C:\WINDOWS\system32\de8296f.sys>
[anti qqsg / antisg]    <\??\C:\Documents and Settings\Administrator\antisg.sys>
[HBKernel32 Driver / HBKernel32]    <\SystemRoot\system32\drivers\HBKernel32.sys>
[f35ee9e / f35ee9e]    <\??\C:\WINDOWS\system32\f35ee9e.sys>

    系统修复－－　浏览器加载项之如下项删除：
[]    <C:\Program Files\Internet Explorer\53u1ttMe.2ys>

由于QQ文件夹里psapi.dll木马下载器的存在

及C盘外分区病毒文件存在

重装系统无效的
除非先将其彻底清理