一、注册表：
1、要删除的：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WinShell><"C:\WINDOWS\system32\Rundll32.exe" "C:\WINDOWS\system32\shell32.dll",Control_RunDLL "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat2A.tmp">
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{C0595A7E-2E2F-4B34-A83A-019270A0A464}><C:\WINDOWS\system32\tdffdl.dll> []
<{c4bf46a2-1c05-427d-992f-4e24f7d57f68}><ttNNBNNB1047.dll> [N/A]
<{6167F471-EF2B-41DD-A5E5-C26ACDB5C096}><C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys> [N/A]
<{7914E0AA-ECCB-4311-B584-C49538227824}><C:\WINDOWS\system32\jhfrxz.dll> []
<{73AE86E6-7F03-4C3B-8980-FB1DA157D3C7}><C:\WINDOWS\system32\fmcvxy.dll> [N/A]
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgrefg.dll> [N/A]
<{F99DEFDD-200B-4410-B572-E90883D527D2}><C:\WINDOWS\system32\wrqszl.dll> [N/A]
<{EB71E0B3-E97D-4D30-8733-E28266467617}><C:\WINDOWS\system32\wyhesm.dll> [N/A]
<{6E6CA8A1-81BC-4707-A54C-F4903DD70BAD}><C:\WINDOWS\system32\zgxfdx.dll> []
<{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zjydcx.dll> [N/A]
<{D29DCEE0-457B-45A2-A92D-741B95B7723B}><C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys> [N/A]
<{1DB3C525-5271-46F7-887A-D4E1ADAA7632}><C:\WINDOWS\system32\hfrdzx.dll> []
<{27D89EDA-2197-4DFC-B3DC-AF22C6CA23BB}><C:\WINDOWS\system32\fedadh.dll> []
<{84143967-B645-4BFF-B873-DA1DC886E9A7}><C:\WINDOWS\system32\cedafb.dll> [N/A]
<{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}><C:\WINDOWS\system32\jhrcar.dll> [N/A]
<{875E07B1-0614-43D9-A76E-D76A28AB3D7B}><C:\WINDOWS\system32\tfsdmz.dll> [N/A]
<{DC3D30AE-0380-4151-8934-EE98A34B0370}><C:\WINDOWS\system32\mfdesy.dll> []
<{841529CB-7F77-4B99-A895-B5441E0D302F}><C:\WINDOWS\system32\jfrwdh.dll> []
<{7FA4A83B-F99A-4bfc-A8E2-6A62B05D2C82}><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat2A.tmp> []
<{1ce220d3-84bb-446c-8a39-6ed491c8a601}><C:\WINDOWS\system32\ttNNBNNB1049.dll> []
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> []
<{6FC63358-5E38-4583-914B-119CA485A53C}><C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys> []
<{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll> []
<{5E907A48-400E-4EA8-9792-FFAE052D59E9}><C:\WINDOWS\system32\pedadt.dll> []
<{ca4c60a2-9e81-406e-bfe3-cd996c2e288f}><C:\WINDOWS\system32\ayRABRAB1019.dll> []
2、要修改的：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><SysWoWa8.dll,msosping02.dll,msosfmsq02.dll,msosmhfp02.dll,msosdohs03.dll,ieprot.dll> [Microsoft Corporation]
二、病毒启动文件夹
[word]
<C:\Documents and Settings\All Users\「开始」菜单\程序\启动\word.lnk --> C:\WINDOWS\system32\raidiap080329.exe [N/A]><N>
三、病毒服务
[29055CF4 / 29055CF4][Stopped/Auto Start]
<C:\WINDOWS\system32\B674A2D4.EXE -d><>
四、病毒驱动程序：
[dohs / dohs][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp9.tmp><N/A>
[mnsf / mnsf][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp><N/A>
[msfpfis64 / msfpfis64][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys><N/A>
[ping / ping][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpB9.tmp><N/A>
[mhfp / mhfp][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp5.tmp><N/A>
[fmsq / fmsq][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp><N/A>
五、病毒浏览器加载项
{6167F471-EF2B-41DD-A5E5-C26ACDB5C096} <C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys, N/A>
{6FC63358-5E38-4583-914B-119CA485A53C} <C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys, N/A>
{D29DCEE0-457B-45A2-A92D-741B95B7723B} <C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys, N/A>
六、病毒文件：
C:\WINDOWS\system32\tdffdl.dll
C:\WINDOWS\system32\ttNNBNNB1047.dll
C:\WINDOWS\system32\jhfrxz.dll
C:\WINDOWS\system32\fmcvxy.dll
C:\WINDOWS\system32\sgrefg.dll
C:\WINDOWS\system32\wrqszl.dll
C:\WINDOWS\system32\wyhesm.dll
C:\WINDOWS\system32\zgxfdx.dll
C:\WINDOWS\system32\zjydcx.dll
C:\WINDOWS\system32\hfrdzx.dll
C:\WINDOWS\system32\fedadh.dll
C:\WINDOWS\system32\cedafb.dll
C:\WINDOWS\system32\jhrcar.dll
C:\WINDOWS\system32\tfsdmz.dll
C:\WINDOWS\system32\mfdesy.dll
C:\WINDOWS\system32\jfrwdh.dll
C:\WINDOWS\system32\ttNNBNNB1049.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\WINDOWS\system32\wyrsdj.dll
C:\WINDOWS\system32\pedadt.dll
C:\WINDOWS\system32\ayRABRAB1019.dll
C:\WINDOWS\system32\SysWoWa8.dll
C:\WINDOWS\system32\msosping02.dll
C:\WINDOWS\system32\msosfmsq02.dll
C:\WINDOWS\system32\msosmhfp02.dll
C:\WINDOWS\system32\msosdohs03.dll
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\word.lnk
C:\WINDOWS\system32\raidiap080329
C:\WINDOWS\system32\B674A2D4.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp9.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat8.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat10.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\dat2A.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpB9.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp5.tmp
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpC.tmp
C:\WINDOWS\system32\drivers\msosmsfpfis64.sys
C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys
C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys
C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys
C:\WINDOWS\system32\42AE09E4.DLL
C:\WINDOWS\system32\WINSvr32.dll
C:\WINDOWS\system32\mfchlp32.dll]
C:\WINDOWS\system32\dndsioc.dll
C:\WINDOWS\system32\fmbiost.dll
C:\WINDOWS\system32\LotusHlp.dll
C:\WINDOWS\system32\DbgHlp32.dlL
C:\WINDOWS\system32\fmsbbqi.dll
C:\WINDOWS\system32\msccrt.dll]
C:\WINDOWS\system32\Kvsc3.dll
C:\WINDOWS\system32\miofrkpr.dll
C:\WINDOWS\system32\MsIMMs32.dll
C:\WINDOWS\system32\upxdnd.dll
