用XDelBox删除以下文件
C:\WINDOWS\pchealth\Global.exe
C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com
C:\WINDOWS\system\KEYBOARD.exe
C:\WINDOWS\Help\microsoft.hlp
C:\WINDOWS\system32\regedit.exe
C:\WINDOWS\system32\drivers\drivers.cab.exe
C:\WINDOWS\system32\dllcache\autorun.inf
C:\WINDOWS\system32\dllcache\Default.exe
C:\WINDOWS\system32\dllcache\svchost.exe
C:\WINDOWS\system32\dllcache\Global.exe
C:\WINDOWS\system32\dllcache\explorer.exe
C:\WINDOWS\system32\dllcache\tskmgr.exe
C:\WINDOWS\system32\dllcache\rndll32.exe
C:\WINDOWS\system32\dllcache\Recycler.645FF040-5081-101B-9F08-00AA002F954E}\system.exe
C:\WINDOWS\system32\dllcache\Recycler.645FF040-5081-101B-9F08-00AA002F954E}\Global.exe
C:\WINDOWS\system32\dllcache\Recycler.645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe
C:\WINDOWS\Fonts\tskmgr.exe
C:\WINDOWS\Fonts\Fonts.exe
C:\WINDOWS\Media\rndll32.pif
以及各个硬盘分区下的
X:\Autorun.inf
X:\MS-DOS.com
以上list导入完毕之后，右键选择立即重起删除，
之后的关机过程可能要等待好几分钟的时间，甚至出现死机，可以强行关机重起。
重起删除后，残留的需要手动清除的病毒尸体还有：
文件夹
C:\WINDOWS\system32\dllcache\Recycler.645FF040-5081-101B-9F08-00AA002F954E}
还有病毒创建的一个可能文件名不确定的.tmp文件（Temp文件夹可以清空）
C:\Documents and Settings\当前用户名\Local Settings\Temp\~DF****.tmp
用SREng修复以下文件关联项：
.REG Error. [C:\WINDOWS\pchealth\Global.exe]
用SREng或者运行C:\WINDOWS\system32\regedt32.exe删除以下注册表启动项
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<><C:\WINDOWS\system\KEYBOARD.exe> []
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<><C:\WINDOWS\system32\dllcache\Default.exe>
<><C:\WINDOWS\system\KEYBOARD.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
<><C:\WINDOWS\system32\dllcache\Default.exe>
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explor
er\Run]
<sys><C:\WINDOWS\Fonts\Fonts.exe>
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com>
运行regedt32.exe，找到类似于以下的映像劫持项，删除之，或者用IFEO清除工具：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\auto.exe]
<IFEO[auto.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\autorun.exe]
<IFEO[autorun.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
FileExecution Options\autoruns.exe]
<IFEO[autoruns.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\boot.exe]
<IFEO[boot.exe]><C:\WINDOWS\Fonts\fonts.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><C:\WINDOWS\Fonts\Fonts.exe>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\msconfig.exe]
<IFEO[msconfig.exe]><C:\WINDOWS\Media\rndll32.pif>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\procexp.exe]
<IFEO[procexp.exe]><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
Execution Options\taskmgr.exe]
<IFEO[taskmgr.exe]><C:\WINDOWS\Fonts\tskmgr.exe>
