由于本人技术有限 做出以下结论：
XDelBox下载：
http://www.dodudou.com/down/ 打开后选择【原创软件】，下载XDelBox1.7支持奥运版。
使用XDelBox删除以下文件：
使用前一定拔掉所有移动存储设备，将下面文件列表内容完整复制，然后打开XDelBox，在“待删除文件列表”下方空白框处右键，选择“剪贴板导入不检查路径”，勾选上方的“抑制再生”、“驱动安全删除模式”、“备份文件”，最后选择右键菜单的“立刻重启删除”。
C:\WINDOWS\fmsiocps.exe
C:\WINDOWS\anistio.exE
C:\WINDOWS\isndntio.exe
C:\WINDOWS\mfchlp64.exe
C:\WINDOWS\bqclhkmi.exe
C:\WINDOWS\fmsjhif.exe
C:\WINDOWS\hefcndy.exe
C:\WINDOWS\ticisms.exe
C:\WINDOWS\ptshell.exe
C:\WINDOWS\huifitc.exe
C:\WINDOWS\bincdwsa.exe
C:\WINDOWS\dndsioc.exe
C:\WINDOWS\yuiabct.exe
C:\WINDOWS\wipicdec.exe
C:\WINDOWS\dionpis.exe
C:\WINDOWS\fmsbbqi.exe
C:\WINDOWS\dbhlp32.exe
C:\WINDOWS\tciocp64.exe
C:\WINDOWS\fmbiost.exe
C:\WINDOWS\WINSvr64.exe
C:\WINDOWS\system32\451C23.EXE
C:\WINDOWS\system32\wipicdec.dll
C:\WINDOWS\system32\psufcq.dll
C:\WINDOWS\system32\msosping00.dll
C:\WINDOWS\system32\frqntr.dll
C:\WINDOWS\system32\msoscqit00.dll
C:\WINDOWS\system32\prfpra.dll
C:\WINDOWS\system32\fmsiocps.dll
C:\WINDOWS\system32\yldypj.dll
C:\WINDOWS\system32\msosdohs00.dll
C:\WINDOWS\system32\msoscqit01.dll
C:\WINDOWS\system32\msosfmsq00.dll
C:\WINDOWS\system32\msosdohs01.dll
C:\WINDOWS\system32\msosjtio00.dll
C:\WINDOWS\system32\msosptfs00.dll
C:\WINDOWS\system32\msosping01.dll
C:\WINDOWS\system32\A110F010.DLL
C:\WINDOWS\system32\mfc40u.dll
C:\WINDOWS\system32\WINSvr64.dll
C:\WINDOWS\system32\camaix.dll
C:\WINDOWS\system32\yuiabct.dll
C:\WINDOWS\system32\dndsioc.dll
C:\WINDOWS\system32\fmbiost.dll
C:\WINDOWS\system32\bincdwsa.dll
C:\WINDOWS\system32\huifitc.dll
C:\WINDOWS\system32\ptshell.dll
C:\WINDOWS\system32\ticisms.dll
C:\WINDOWS\system32\hefcndy.dll
C:\WINDOWS\system32\tciocp64.dll
C:\WINDOWS\system32\dbhlp32.dlL
C:\WINDOWS\system32\fmsbbqi.dll
C:\WINDOWS\system32\fmsjhif.dll
C:\WINDOWS\system32\hmvcbmbk.dll
C:\WINDOWS\system32\mfchlp64.dll
C:\WINDOWS\system32\isndntio.dll
C:\WINDOWS\system32\dionpis.dll
C:\WINDOWS\system32\anistio.dll
C:\WINDOWS\system32\cxayqo.dll
C:\WINDOWS\RSHIDE
====================================
重启计算机后会看到一个请选择要启动的操作系统的提示，倒计时5秒，
第一个选项是你自己的Windows系统，
第二个选项是XDelBox的Go XDelBox To Del Files，
默认自动选择第二项，会进入类似DOS的界面，这期间什么操作都不用做，等待它自动运行即可，
待病毒文件删除后会自动重启进入Windows系统，
然后再按以下步骤操作
=======================================
运行SRENG扫描工具，选择【启动项目】-【注册表】，将以下项删除：
<fmsiocps>
<anistio>
<isndntio>
<mfchlp64>
<tbmqichl
<fmsjhif>
<hefcndy>
<ticisms>
<ptshell>
<huifitc>
<bincdwsa>
<dndsioc>
<yuiabct>
<wipicdec>
<dionpis>
<fmsbbqi>
<dbhlp32>
<tciocp64>
<fmbiost>
<WINSvr64>
找到 <AppInit_DLLs> 双击 把里面的值改为空
由于本人技术原因 以下劫持望高手指教：[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avconsol.exe]
<IFEO[avconsol.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe]
<IFEO[egui.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\esafe.exe]
<IFEO[esafe.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe]
<IFEO[idag.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe]
<IFEO[kaccore.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KaScrScn.SCR]
<IFEO[KaScrScn.SCR]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPF.exe]
<IFEO[KAVPF.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe]
<IFEO[kavsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvcUI.exe]
<IFEO[KAVsvcUI.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe]
<IFEO[kissvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRepair.com]
<IFEO[KRepair.com]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp]
<IFEO[KVCenter.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE]
<IFEO[KVFW.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP_1.kxp]
<IFEO[KVMonXP_1.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp]
<IFEO[KvReport.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVScan.kxp]
<IFEO[KVScan.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVStub.kxp]
<IFEO[KVStub.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navapsvc.exe]
<IFEO[navapsvc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
<IFEO[Navapw32.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NPFMntor.exe]
<IFEO[NPFMntor.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyDBG.EXE]
<IFEO[OllyDBG.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OllyICE.EXE]
<IFEO[OllyICE.EXE]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]
<IFEO[procexp.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qqsc.exe]
<IFEO[qqsc.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtimer.exe]
<IFEO[ravtimer.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravtool.exe]
<IFEO[ravtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regtool.exe]
<IFEO[regtool.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exeFYFireWall.exe]
<IFEO[rfwproxy.exeFYFireWall.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Component Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwstub.exe]
<IFEO[rfwstub.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rising.exe]
<IFEO[rising.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe]
<IFEO[safebank.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]
<IFEO[TrojDie.kxp]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe]
<IFEO[UpLive.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]
<IFEO[vsstat.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]
<IFEO[webscanx.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows XP Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinDbg.exe]
<IFEO[WinDbg.exe]><C:\WINDOWS\system32\svchost.exe> [(Verified)Microsoft Windows Publisher]
===========================================
打开SRENG 选择【启动项目】-【服务】-【win32服务应用程序】
删除：
[99A4837 / 99A4837][Stopped/Auto Start]
<C:\WINDOWS\system32\451C23.EXE -d><>
=======================================
运行SRENG扫描工具，选择【系统修复】-【浏览器加载项】，将以下项删除：
[]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys, N/A>
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys, N/A>
=========================================
由于本人技术有限 IFEO望高手解决 做完后更新杀毒软件至最新，进行全盘杀毒 弄好后再发日志上来
看看还有那些残余文件~
