我还原，删除各盘文件 批处理了_desktop.ini desktop_.ini，但是```部分.exe程序或则是安装包点击后病毒又起来了。
我这是算中了传说中的威金应该吧。
小弟在线期待中``望高手指点一下呀``

这问题很粗？还是太幼稚？大家别这样把我抛弃了呀！！！

HijackThis_zww汉化版扫描日志 V1.99.1
保存于      19:35:03, 日期 2008-3-25
操作系统：  Windows XP SP2 (WinNT 5.01.2600)
浏览器：    Internet Explorer v6.00 SP2 (6.00.2900.2180)

当前运行的进程：         
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\conime.exe
c:\program files\internet explorer\iexplore.exe
h:\临时文件夹\antivirus2007--安全中国anqn.com\antivirus.com
f:\tools\hijackthis1[1].99.1\hijackthis1991zww.exe

O1 - Hosts: 124.238.254.113 www.10280011.com
O1 - Hosts: 124.238.254.113 10280011.com
O1 - Hosts: 124.238.254.113 www.10289900.com
O1 - Hosts: 124.238.254.113 10289900.com
O1 - Hosts: 124.238.254.113 www.78877788.com
O1 - Hosts: 124.238.254.113 78877788.com
O1 - Hosts: 124.238.254.113 www.11051122.com
O1 - Hosts: 124.238.254.113 11051122.com
O1 - Hosts: 124.238.254.113 1.ehai01.com
O1 - Hosts: 124.238.254.113 da.ehai01.com
O1 - Hosts: 124.238.254.113 ehai01.com
O1 - Hosts: 124.238.254.113 2008.sekart.cn
O1 - Hosts: 124.238.254.113 www.sekart.cn
O1 - Hosts: 124.238.254.113 sekart.cn
O1 - Hosts: 124.238.254.113 www.11309988.com
O1 - Hosts: 124.238.254.113 www.12100088.com
O1 - Hosts: 124.238.254.113 www.12108899.com
O1 - Hosts: 124.238.254.113 d2.llsging.com
O1 - Hosts: 124.238.254.113 llsging.com
O1 - Hosts: 124.238.254.113 dd.749571.com
O1 - Hosts: 124.238.254.113 749571.com
O1 - Hosts: 124.238.254.113 pr.749571.com
O1 - Hosts: 124.238.254.113 txwm1204.com
O1 - Hosts: 124.238.254.113 www.txwm1204.com
O2 - BHO: Thunder AtOnce - {01443AEC-0FD1-40fd-9C87-E93D1494C233} - C:\Program Files\Thunder Network\Thunder\ComDlls\TDAtOnce_Now.dll
O2 - BHO: (no name) - {6167F471-EF2B-41DD-A5E5-C26ACDB5C096} - C:\Program Files\Internet Explorer\PLUGINS\WinSys8v.Sys
O2 - BHO: ThunderBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\ComDlls\xunleiBHO_Now.dll
O2 - BHO: SafeMon Class - {B69F34DD-F0F9-42DC-9EDD-957187DA688D} - C:\Program Files\360safe\safemon\safemon.dll
O4 - 启动项HKLM\\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - 启动项HKLM\\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - 启动项HKLM\\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - 启动项HKLM\\Run: [SlowDownCPU] C:\WINDOWS\INF\MSI\SlowDownCPU\SlowDownCPU.exe
O4 - 启动项HKLM\\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - 启动项HKLM\\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - 启动项HKLM\\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - 启动项HKLM\\Run: [360Safetray] C:\Program Files\360safe\safemon\360tray.exe /start
O4 - 启动项HKLM\\Run: [MSConfig] c:\windows\pchealth\helpctr\binaries\msconfig.exe /auto
O4 - 启动项HKLM\\Run: [TBMonEx] C:\WINDOWS\Fonts\00-13-D3-99-19-C3\system\wdfmgr.exe
O8 - IE右键菜单中的新增项目: &V使用Vagaa哇嘎下载 - G:\Vagaa\Data\vg.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载 - C:\Program Files\Thunder Network\Thunder\Program\geturl.htm
O8 - IE右键菜单中的新增项目: 使用迅雷下载全部链接 - C:\Program Files\Thunder Network\Thunder\Program\getallurl.htm
O8 - IE右键菜单中的新增项目: 添加到QQ表情 - E:\Tencent\QQ\AddEmotion.htm
O9 - 浏览器额外的按钮: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的“工具”菜单项: 启动迅雷5 - {09BA8F6D-CB54-424B-839C-C2A6C8E6B436} - C:\Program Files\Thunder Network\Thunder\Thunder.exe
O9 - 浏览器额外的按钮: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - 浏览器额外的“工具”菜单项: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{0B56A527-A815-4033-A07D-1EBA86A3F0DB}: NameServer = 202.101.98.55
O20 - AppInit_DLLs: mhtd.dll,qnefnaib.dll,ej.dll,uixauh.dll,hjiq.dll,kiluw.dll,dsfg.dll,yqhs.dll,oaijihzeuyouhz.dll,jemnaw.dll,cuhad.dll,laixuhz.dll,rfhx.dll,mnauygniqaixnaij.dll,oqnauhc.dll,xjxr.dll,utiemnaw.dll,sve.dll,wininat.dll,gnolnait.dll,zadnew.dll,htwx.dll,knaixnauhuoyizqq.dll,duygnef.dll,gmx.dll,nadgnohiac.dll,agzg.dll,qlihzouhgnfe.dll,bchib.dll,tzm.dll,r2.dll,bauhgnem.dll,eohsom.dll,fyom.dll,sauhad.dll,ijougiemnaw.dll,taijoad.dll,lnaixnauhqq.dll,idtj.dll,vhqq.dll,atgnehz.dll,rsqq.dll,tsqc.dll,vauyiqvlnaix.dll,wQ.dll,fmxh.dll,cty.dll,pahzij.dll,jz.dll,bz.dll,pyomielnux.dll,slcs.dll,xptyj.dll,umqj.dll,xqjy.dll,fifeei.dll,shqein.dll,xy2.dll,wtiemnaw.dll,uyomielnux.dll,vlihzouhgnfe.dll,2ty.dll,nauhgnem.dll,auhad.dll,rj.dll,hz.dll,naijihzeuyouhz.dll,xhqq.dll,jmx.dll,dgzg.dll,gsqq.dll,fz.dll,gnaixnauhuoyizqq.dll,gnolnait.dll,jsqc.dll,dqncj.dll,eve.dll,2nauygniqaixnaij.dll,niluw.dll,ijougiemnaw.dll,xhtd.dll,QQ.dll,sfhx.dll,gnaixnauhqq.dll,3auhad.dll,oadnew.dll,iemnaw.dll,qcsct.dll,oadgnohiac.dll,iqnauhc.d
O23 - NT 服务: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - NT 服务: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - NT 服务: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - NT 服务: XDSERVER - Unknown owner - C:\WINDOWS\system\tes.exe

直接弄个sreng 的上来看看！

好汉``sreng来了，帮我分析分析

删除

c:\program files\internet explorer\plugins\winsys8v.sys
c:\windows\system32\avpsrv.dll
c:\windows\system32\lotushlp.dll
c:\windows\system32\navmon32.dll
c:\windows\system32\ptsshell.dll
c:\windows\system32\shaproc.dat
c:\windows\system32\wsockdrv32.dll
c:\program files\winrar\rarext.dll
c:\windows\system32\aycbdcbd1041.dll
c:\windows\system32\ayfkkfkk1053.dll
c:\windows\system32\aynnbnnb1042.dll
c:\windows\system32\aysadsad1026.dll
c:\windows\system32\cuhad.dll
c:\windows\system32\ijougiemnaw.dll
c:\windows\system32\jyjlt.dll
c:\windows\system32\kvsc3.dll
c:\windows\system32\laixuhz.dll
c:\windows\system32\oqrthc.dll
c:\windows\system32\upxdnd.dll
c:\windows\system32\xjxr.dll
c:\windows\system32\yqhs.dll
c:\windows\inf\msi\slowdowncpu\rushtop.dll
c:\windows\system32\eohsom.dll
c:\windows\system32\vmvreg32.dll

; c:\windows\wsockdrv32.exe
; c:\windows\upxdnd.exe
; c:\windows\shaproc.exe
; c:\windows\ptsshell.exe
; c:\windows\navmon32.exe
; c:\windows\lotushlp.exe
; c:\windows\kvsc3.exe
; c:\windows\avpsrv.exe
c:\windows\system32\drivers\31.tmp
c:\docume~1\yy\locals~1\temp\usbhcid.sys
c:\docume~1\yy\locals~1\temp\usbcams3.sys
c:\windows\system32\drivers\msosfpids32.sys
c:\docume~1\yy\locals~1\temp\tmp24.tmp

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[load]    <>
[WSockDrv32]    <; C:\WINDOWS\WSockDrv32.exe>
[upxdnd]    <; C:\WINDOWS\upxdnd.exe>
[SHAProc]    <; C:\WINDOWS\SHAProc.exe>
[PTSShell]    <; C:\WINDOWS\PTSShell.exe>
[NAVMon32]    <; C:\WINDOWS\NAVMon32.exE>
[LotusHlp]    <; C:\WINDOWS\LotusHlp.exe>
[Kvsc3]    <; C:\WINDOWS\Kvsc3.exE>
[AVPSrv]    <; C:\WINDOWS\AVPSrv.exE>

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
[NPF / NPF]    <\??\C:\WINDOWS\system32\drivers\31.tmp>
[iCafe Manager / iCafe Manager]    <\??\C:\DOCUME~1\yy\LOCALS~1\Temp\usbhcid.sys>
[Sc Manager / Sc Manager]    <\??\C:\DOCUME~1\yy\LOCALS~1\Temp\usbcams3.sys>
[fpids32 / fpids32]    <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
[MS / MS]    <\??\C:\DOCUME~1\yy\LOCALS~1\Temp\tmp24.tmp>

    系统修复－－ HOSTS文件－－重置

【回复“花花雪狐”的帖子】
谢谢好汉，我想再问下，有没有办法可以恢复那些被感染的exe．．

这个就不知道了，还真没考虑过这个问题！

1.重装被感染的exe文件

2.把病毒上报给瑞星，等着瑞星杀了

引用:

【流星陨落的贴子】1.重装被感染的exe文件 2.把病毒上报给瑞星，等着瑞星杀了 ………………

就是不敢用杀软，怕东西全被删掉了，最后没办法还是用了``几乎一半的收藏都毁了我诅咒做这毒的王八蛋