注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ctfmon.exe><C:\WINDOWS\system32\ctfmon.exe> [(Infected) Microsoft Corporation]
由此看出系统输入法进程被病毒感染，但不需对以上注册表值项做任何操作。
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<Alcmtr><anymie360.exe> []
病毒添加的注册表启动项，删除。
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><C:\WINDOWS\fonts\ComRes.dll> []
病毒添加的初始化动态链接库启动项，拔网线，关闭杀软监控后将此注册表值项值清空，不要删除值项本身。
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{21163FF2-8EB3-421D-9964-C0F5F30DB08C}><C:\WINDOWS\system32\ihhmjffi.dll> [File is missing]
<{7AA9FFE0-0C4B-4506-87B5-9DF7EC41E3BF}><C:\WINDOWS\system32\naapffeg.dll> [File is missing]
<{83F7E10C-4025-4983-BAEA-12D85E6B9134}><C:\WINDOWS\system32\ojfnehgc.dll> [File is missing]
<{3B31E2C9-4EFA-4A0D-8ABF-FC3E1EE6BE4E}><C:\WINDOWS\system32\jbjheicp.dll> [File is missing]
<{023DEAFC-CEB4-41F9-AE4A-29A4661E8B42}><C:\WINDOWS\system32\gijdeafc.dll> []
<{B0451506-911B-4B31-8DF5-8F00F87C6CAA}><C:\WINDOWS\system32\bgklhlgm.dll> []
<{F6E7509F-D932-47A2-B163-C6EA64C8C99E}><C:\WINDOWS\system32\fmenlgpf.dll> []
<{5CFA9F11-57F3-4166-AA20-CAA3ACCB7E47}><C:\WINDOWS\system32\lcfapfhh.dll> []
<{63850067-0D21-4DC1-AFDB-A915EC99E1AC}><C:\WINDOWS\system32\mjolggmn.dll> []
<{6C23D952-5363-4711-A71D-FE2396F8808C}><C:\WINDOWS\system32\mcijdpli.dll> [File is missing]
<{C84A82E3-728A-4E17-B6D5-21E086698675}><C:\WINDOWS\system32\cokaoiej.dll> []
<{7372D4A7-2F7C-4670-BB03-411A199DA049}><C:\WINDOWS\system32\njnidkan.dll> []
<{BAA8D4A2-0336-490A-ABD5-E23AA4078C3A}><C:\WINDOWS\system32\baaodkai.dll> [File is missing]
<{CE02D995-6C8F-4626-8EAD-AC1B51150E9E}><C:\WINDOWS\system32\cegidppl.dll> []
<{087A5940-DEF5-4EEE-9382-D43EAFC7A56C}><C:\WINDOWS\system32\gonalpkg.dll> []
<{508A6B1C-6FC1-423C-9541-FFDA4F1B1CEC}><C:\WINDOWS\system32\lgoambhc.dll> []
<{DF7576E9-8841-4895-9BE4-6667047EED5C}><C:\WINDOWS\system32\dfnlnmep.dll> [File is missing]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<21163FF2><C:\WINDOWS\system32\ihhmjffi.dll> [File is missing]
<7AA9FFE0><C:\WINDOWS\system32\naapffeg.dll> [File is missing]
<83F7E10C><C:\WINDOWS\system32\ojfnehgc.dll> [File is missing]
<3B31E2C9><C:\WINDOWS\system32\jbjheicp.dll> [File is missing]
<023DEAFC><C:\WINDOWS\system32\gijdeafc.dll> []
<B0451506><C:\WINDOWS\system32\bgklhlgm.dll> []
<F6E7509F><C:\WINDOWS\system32\fmenlgpf.dll> []
<5CFA9F11><C:\WINDOWS\system32\lcfapfhh.dll> []
<63850067><C:\WINDOWS\system32\mjolggmn.dll> []
<6C23D952><C:\WINDOWS\system32\mcijdpli.dll> [File is missing]
<C84A82E3><C:\WINDOWS\system32\cokaoiej.dll> []
<7372D4A7><C:\WINDOWS\system32\njnidkan.dll> []
<BAA8D4A2><C:\WINDOWS\system32\baaodkai.dll> [File is missing]
<CE02D995><C:\WINDOWS\system32\cegidppl.dll> []
<087A5940><C:\WINDOWS\system32\gonalpkg.dll> []
<508A6B1C><C:\WINDOWS\system32\lgoambhc.dll> []
<DF7576E9><C:\WINDOWS\system32\dfnlnmep.dll> [File is missing]
以上注册表值项均为病毒添加，删除。
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsTray.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe]
直接删除上面这三个注册表子项，它们是病毒释放的IFEO项，用于劫持杀软、防火墙和迅雷的进程。
==================================
驱动程序
[Safe Mon 360 / SafeMon0][Running/System Start]
<\??\C:\WINDOWS\system32\F32E7136.dat><N/A>
[msiffei / msiffei][Stopped/Manual Start]
<System32\Drivers\msiffei.sys><N/A>
两个病毒驱动，可用SRENG扫描工具删除。
==================================
正在运行的进程
[PID: 1212 / Administrator][C:\WINDOWS\system32\ctfmon.exe] [(Infected) Microsoft Corporation, 5.1.2600.5512 (xpsp.080413-2105)]
被感染的系统输入法文件，用正常的替换掉。
[PID: 876 / SYSTEM][C:\WINDOWS\system32\svchost.exe] [(Verified) Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\anymie360.dll] [N/A, ][PID: 1984 / Administrator][C:\WINDOWS\Explorer.EXE] [(Verified) Microsoft Corporation, 6.00.2900.3156 (xpsp_sp2_qfe.070613-1311)]
[C:\WINDOWS\system32\anymie360.dll] [N/A, ][PID: 3240 / Administrator][C:\Program Files\Internet Explorer\iexplore.exe] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\fonts\ComRes.dll] [N/A, ]
[C:\WINDOWS\fonts\ctm01025.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm04004.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm09003.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm11008.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm12004.ttf] [N/A, ][PID: 3712 / Administrator][C:\Program Files\Rising\Rav\RsAgent.exe] [Beijing Rising Information Technology Co., Ltd., 21.0.0.17]
[C:\WINDOWS\fonts\ComRes.dll] [N/A, ]
[C:\WINDOWS\fonts\ctm01025.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm04004.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm09003.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm11008.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm12004.ttf] [N/A, ][PID: 3416 / Administrator][C:\Program Files\WinRAR\WinRAR.exe] [N/A, ]
[C:\WINDOWS\fonts\ComRes.dll] [N/A, ]
[C:\WINDOWS\fonts\ctm01025.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm04004.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm09003.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm11008.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm12004.ttf] [N/A, ][PID: 3288 / Administrator][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.438\SREngLdr.EXE] [Smallfrogs Studio, 2.7.0.1210]
[C:\WINDOWS\fonts\ComRes.dll] [N/A, ]
[C:\WINDOWS\fonts\ctm01025.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm04004.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm09003.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm11008.ttf] [N/A, ]
[C:\WINDOWS\fonts\ctm12004.ttf] [N/A, ]以上红色项目为插入到正常进程的病毒模块，用XDELBOX的“立即重启执行删除”收拾。
没有出现在“正在运行的进程”内容中的病毒文件如下，也用XDELBOX连同上面的一起搞定：
C:\WINDOWS\system32\anymie360.exe
C:\WINDOWS\system32\F32E7136.dat
C:\WINDOWS\System32\Drivers\msiffei.sys
C:\WINDOWS\system32\ihhmjffi.dll
C:\WINDOWS\system32\naapffeg.dll
C:\WINDOWS\system32\ojfnehgc.dll
C:\WINDOWS\system32\jbjheicp.dll
C:\WINDOWS\system32\gijdeafc.dll
C:\WINDOWS\system32\bgklhlgm.dll
C:\WINDOWS\system32\fmenlgpf.dll
C:\WINDOWS\system32\lcfapfhh.dll
C:\WINDOWS\system32\mjolggmn.dll
C:\WINDOWS\system32\mcijdpli.dll
C:\WINDOWS\system32\cokaoiej.dll
C:\WINDOWS\system32\njnidkan.dll
C:\WINDOWS\system32\baaodkai.dll
C:\WINDOWS\system32\cegidppl.dll
C:\WINDOWS\system32\gonalpkg.dll
C:\WINDOWS\system32\lgoambhc.dll
C:\WINDOWS\system32\dfnlnmep.dll
C:\WINDOWS\system32\anymie360.dll
C:\WINDOWS\fonts\ComRes.dll
C:\WINDOWS\fonts\ctm01025.ttf
C:\WINDOWS\fonts\ctm04004.ttf
C:\WINDOWS\fonts\ctm09003.ttf
C:\WINDOWS\fonts\ctm11008.ttf
C:\WINDOWS\fonts\ctm12004.ttf
==================================
【注意】：请注意认真看我前一个帖子中链接帖的内容，搞懂以后，再操作。
