初步的：[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> []
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\comie.exe
C:\WINDOWS\System32\HURN043577.dat
C:\WINDOWS\system32\bp8wddFqfaagBTyD.dll
C:\WINDOWS\system32\ZfbJ9AWwU.dll
C:\WINDOWS\system32\DcXb7abe.dll
C:\WINDOWS\system32\hhnt2pBK.dll
C:\WINDOWS\system32\A0C86020.dll
C:\WINDOWS\system32\t44y9a553NQ.dll
C:\WINDOWS\system32\EN7hzSreCat8.dll
C:\WINDOWS\system32\08223B03.dll
C:\WINDOWS\system32\JGxmCj7bYHHbwtxt.dll
C:\WINDOWS\system32\E4814792.dll
C:\WINDOWS\system32\ndxq9awMc.dll
C:\WINDOWS\system32\CDuAUVkGy9.dll
C:\WINDOWS\system32\A1A6BC2E.dll
C:\WINDOWS\system32\GU6f5sW42mdc.dll
C:\WINDOWS\system32\cRsAQd4hw.dll
C:\WINDOWS\system32\yZBe42ZrDxZA.dll
C:\WINDOWS\system32\skcfujQ5EDN.dll
C:\WINDOWS\system32\Va7SpUWgCA5f.dll
C:\WINDOWS\system32\122B901E.dll
C:\WINDOWS\fonts\Bd9YDPZwvZzQHnv.fon
C:\WINDOWS\fonts\A97CRaCB.fon
C:\WINDOWS\fonts\uXUsF2RrQy.fon
C:\WINDOWS\fonts\ArF75C89B2WRfRc.fon
C:\WINDOWS\fonts\CtZ8uc499k.fon
C:\WINDOWS\fonts\MqppW9KYn.fon
C:\WINDOWS\fonts\vwuXtYbhj.fon
C:\WINDOWS\fonts\MbsV2QQJe.fon
C:\Documents and Settings\Administrator\Application Data\Microsoft\Internet Explorer\Exp.Dll
C:\WINDOWS\system32\dhDhwS7fFW.dll
C:\Program Files\Internet Explorer\PLUGINS\dl.sys
C:\WINDOWS\system32\JPccCJnKygDdp3.dll
C:\WINDOWS\system32\ed78ab9.dll
C:\WINDOWS\system32\kSVHjMeWr5ZZY47.dll
C:\Documents and Settings\Administrator\Application Data\Spy009.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~2ef37e.tmp
C:\WINDOWS\system32\drivers\acpiec.sys
C:\WINDOWS\System32\HURN043577.dat
C:\WINDOWSupdate.dll
C:\WINDOWS\system32\E4814792.dll
C:\Documents and Settings\Administrator\Application Data\Spy9.dll
D:\Program Files\Tencent\QQ\Bin\PSAPI.DLL
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42406
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42373
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42439
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42472
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42505
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\183401
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42538
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42571
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42604
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42637
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42670
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42703
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42736
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42769
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\42802
在正常机子找到EXPLORER.EXE
COMRes.dll
分别放到C:\Windows\
C:\Windows\System32\
EXPLORER.EXE：先结束进程，直接复制
COMRes.dll用Windows资源管理器改名
C:\Windows\System32\COMRes.dll
接着把正常的覆盖
搜索Autorun.inf删除
显示隐藏文件夹，删除盘根目录【如C: \下的】Autorun.inf指向的EXE文件删除
删除QQ目录下的PASPI.DLL、Usp10.DLL、MSIMG32.DLL
要不删除重启后抓紧打开杀毒软件
