相关软件下载地址：
冰刃：http://www4.skycn.com/soft/37828.html
文件删除终结者（XDelBox）：http://www4.skycn.com/soft/24833.html

把冰刃的压缩包放在桌面上，直接用RAR打开，修改主程序名称（防止IFEO劫持），并且直接双击打开冰刃主程序

同样把XDelBox，SRE两款软件的下载的压缩包（请重新下载）放在桌面上，同样用用RAR打开，修改主程序名称（防止IFEO劫持）
打开XDelBox，SRE这两款软件，以备使用

选择 文件（上方的）  设置  选中  禁止进线程建立

结束下列系统非关键进程：
[PID: 2696 / Administrator][C:\WINDOWS\Fonts\system\dd.exe]
[PID: 3564 / Administrator][C:\Program Files\WinRAR\WinRAR.exe]
[PID: 3984 / Administrator][D:\Program Files\QQ2007\QQ.exe]
[PID: 2440 / Administrator][C:\Program Files\Thunder\Program\Thunder5.exe]
[PID: 2264 / Administrator][C:\Program Files\TTPlayer\TTPlayer.exe]
[PID: 1940 / Administrator][C:\Program Files\Rising\AntiSpyware\Rsaupd.exe]
[PID: 3580 / Administrator][C:\WINDOWS\system32\calc.exe]
[PID: 1396 / Administrator][E:\Nisky\网络游戏\o2jam\motou.exe]
[PID: 1020 / Administrator][C:\WINDOWS\system32\conime.exe]
[PID: 1776 / Administrator][E:\Nisky\网络游戏\o2jam\otwo.exe]
[PID: 1656 / Administrator][E:\Nisky\网络游戏\o2jam\otwo.exe]
[PID: 824 / Administrator][C:\WINDOWS\Fonts\system\ati2evxx.exe]
[PID: 3780 / Administrator][D:\Program Files\QQ2007\TIMPlatform.exe]
[PID: 2616 / Administrator][C:\Program Files\Rising\AntiSpyware\runiep.exe]
[PID: 1604 / SYSTEM][C:\WINDOWS\system32\nvsvc32.exe]
[PID: 1428 / Administrator][C:\WINDOWS\system32\CTFMON.EXE]
[PID: 1356 / Administrator][C:\WINDOWS\Explorer.EXE]

利用冰刃中的文件（下面的）找到下面的文件 点右键复制到一个备份文件夹中：
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
C:\WINDOWS\Fonts\system\ati2evxx.exe
C:\WINDOWS\Fonts\system\soundma.exe
C:\WINDOWS\WinForm.exE
C:\WINDOWS\WSockDrv32.exe
C:\WINDOWS\NVDispDRV.EXE
C:\WINDOWS\PTSShell.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\MsPrint32D.exe
C:\WINDOWS\LotusHlp.exe
C:\WINDOWS\Fonts\system\dd.exe
C:\WINDOWS\Fonts\system\fbd.exe
E:\Nisky\网络游戏\o2jam\motou.exe
C:\WINDOWS\Fonts\system\inudhya.dll
C:\WINDOWS\system32\kawdizy.dll
C:\WINDOWS\system32\gjcscyc.dll
C:\WINDOWS\system32\kvdxsmma.dll
C:\WINDOWS\system32\wszjdzx.dll
C:\WINDOWS\system32\swjqbzc.dll
C:\WINDOWS\system32\wsmsezx.dll
C:\WINDOWS\system32\swrcfzc.dll
C:\WINDOWS\system32\ratbspi.dll
C:\WINDOWS\system32\avwlimn.dll
C:\WINDOWS\system32\avwghmn.dll
C:\WINDOWS\system32\avzxmmn.dll
C:\WINDOWS\system32\jsqxayc.dll
C:\WINDOWS\system32\raqjkpi.dll
C:\WINDOWS\system32\gjtmayc.dll
C:\WINDOWS\system32\5823783027.dll
C:\WINDOWS\system32\gjgfcyc.dll
C:\WINDOWS\system32\kapjgzy.dll
C:\WINDOWS\system32\rsjzapm.dll
C:\WINDOWS\system32\WinForm.dll
C:\WINDOWS\system32\WSockDrv32.dll
C:\WINDOWS\system32\NVDispDrv.dll
C:\WINDOWS\system32\PTSShell.dll
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\MsPrint32D.dll 
C:\WINDOWS\system32\avzxmmn.dll
C:\WINDOWS\system32\LotusHlp.dll
C:\ntldr.exe
等病毒清除成功后压缩给我（备份病毒）



[用户系统信息]Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; TencentTraveler ; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.0.04506; InfoPath.2)

利用强制删除 删除以下文件（遇到无法删除的文件，利用已经打开的XDelBox删除）：
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
C:\WINDOWS\Fonts\system\ati2evxx.exe
C:\WINDOWS\Fonts\system\soundma.exe
C:\WINDOWS\WinForm.exE
C:\WINDOWS\WSockDrv32.exe
C:\WINDOWS\NVDispDRV.EXE
C:\WINDOWS\PTSShell.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\MsPrint32D.exe
C:\WINDOWS\LotusHlp.exe
C:\WINDOWS\Fonts\system\dd.exe
C:\WINDOWS\Fonts\system\fbd.exe
E:\Nisky\网络游戏\o2jam\motou.exe
C:\WINDOWS\Fonts\system\inudhya.dll
C:\WINDOWS\system32\kawdizy.dll
C:\WINDOWS\system32\gjcscyc.dll
C:\WINDOWS\system32\kvdxsmma.dll
C:\WINDOWS\system32\wszjdzx.dll
C:\WINDOWS\system32\swjqbzc.dll
C:\WINDOWS\system32\wsmsezx.dll
C:\WINDOWS\system32\swrcfzc.dll
C:\WINDOWS\system32\ratbspi.dll
C:\WINDOWS\system32\avwlimn.dll
C:\WINDOWS\system32\avwghmn.dll
C:\WINDOWS\system32\avzxmmn.dll
C:\WINDOWS\system32\jsqxayc.dll
C:\WINDOWS\system32\raqjkpi.dll
C:\WINDOWS\system32\gjtmayc.dll
C:\WINDOWS\system32\5823783027.dll
C:\WINDOWS\system32\gjgfcyc.dll
C:\WINDOWS\system32\kapjgzy.dll
C:\WINDOWS\system32\rsjzapm.dll
C:\WINDOWS\system32\WinForm.dll
C:\WINDOWS\system32\WSockDrv32.dll
C:\WINDOWS\system32\NVDispDrv.dll
C:\WINDOWS\system32\PTSShell.dll
C:\WINDOWS\system32\upxdnd.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\MsPrint32D.dll 
C:\WINDOWS\system32\avzxmmn.dll
C:\WINDOWS\system32\LotusHlp.dll
F:\ntldr.exe
C:\ntldr.exe
D:\ntldr.exe
E:\ntldr.exe
F:\Autorun.inf
C:\Autorun.inf
D:\Autorun.inf
E:\Autorun.inf
删除文件夹C:\WINDOWS\Fonts\system\下所有文件
并删除C:\WINDOWS\Fonts\system\文件夹

保证文件不存在，重新启动计算机

直接从桌面打开冰刃，点注册表，找到HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
删除
    <MSConfig><C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe /auto>  [(Verified)Microsoft Windows Publisher]
    <TBMonEx><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
    <inudhya><C:\WINDOWS\Fonts\system\soundma.exe>  []
    <WinForm><C:\WINDOWS\WinForm.exE>  []
    <WSockDrv32><C:\WINDOWS\WSockDrv32.exe>  []
    <NVDispDrv><C:\WINDOWS\NVDispDRV.EXE>  []
    <PTSShell><C:\WINDOWS\PTSShell.exe>  []
    <upxdnd><C:\WINDOWS\upxdnd.exe>  []
    <cmdbcs><C:\WINDOWS\cmdbcs.exe>  []
    <MsPrint32D><C:\WINDOWS\MsPrint32D.exe>  []
    <LotusHlp><C:\WINDOWS\LotusHlp.exe>  []
    <kermer><C:\WINDOWS\Fonts\system\dd.exe>  []
    <kkaddmin><C:\WINDOWS\Fonts\system\fbd.exe>  []
<InternetExe><E:\Nisky\网络游戏\o2jam\motou.exe>
再找到HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
删除
    <{98907901-1416-3389-9981-372178569989}><C:\WINDOWS\system32\kawdizy.dll>  []
    <{3FA10261-B890-F432-A453-69F1023513F3}><C:\WINDOWS\system32\gjcscyc.dll>  []
    <{DD561258-45F3-A451-F908-A258458226DD}><C:\WINDOWS\system32\kvdxsmma.dll>  []
    <{45679330-4034-9021-7012-909856721374}><C:\WINDOWS\system32\wszjdzx.dll>  []
    <{24909874-8982-F344-A322-7898787FA742}><C:\WINDOWS\system32\swjqbzc.dll>  []
    <{792FADFA-BCDE-ACDF-CDEF-21054865CBA7}><C:\WINDOWS\system32\wsmsezx.dll>  []
    <{778A7521-FA87-34AB-34C2-4893F3AD34C7}><C:\WINDOWS\system32\swrcfzc.dll>  []
    <{47650011-3344-6688-4899-345FABCD1574}><C:\WINDOWS\system32\ratbspi.dll>  []
    <{9960356A-458E-DE24-BD50-268F589A56A9}><C:\WINDOWS\system32\avwlimn.dll>  []
    <{8A1247C1-53DA-FF43-ABD3-345F323A48D8}><C:\WINDOWS\system32\avwghmn.dll>  []
    <{D859245F-345D-BC13-AC4F-145D47DA34FD}><C:\WINDOWS\system32\avzxmmn.dll>  []
    <{1D098345-9012-8750-8910-9128098134D1}><C:\WINDOWS\system32\jsqxayc.dll>  []
    <{B4783410-4F90-34A0-7820-3230ACD05F4B}><C:\WINDOWS\system32\raqjkpi.dll>  []
    <{1C098A56-F90F-A789-901F-8906546720C1}><C:\WINDOWS\system32\gjtmayc.dll>  []
    <{1456907A-0772-492A-B683-232BAFC33AD4}><C:\WINDOWS\system32\5823783027.dll>  []
    <{3D30695F-C54D-32AD-BC43-5810F301A1D3}><C:\WINDOWS\system32\gjgfcyc.dll>  []
    <{7A321487-4977-D98A-C8D5-6488257545A7}><C:\WINDOWS\system32\kapjgzy.dll>  []
    <{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\system32\rsjzapm.dll>  []
检查以上文件和注册表内容是否删除干净

删除干净后，再重新启动计算机，修复被病毒修改的系统

利用SRE修复HOST文件（删除下列选项）
124.238.254.113        www.10280011.com
124.238.254.113        10280011.com
124.238.254.113        www.10289900.com
124.238.254.113        10289900.com
124.238.254.113        www.78877788.com
124.238.254.113        78877788.com
124.238.254.113        www.11051122.com
124.238.254.113        11051122.com
124.238.254.113        1.ehai01.com
124.238.254.113        da.ehai01.com
124.238.254.113        ehai01.com
124.238.254.113        2008.sekart.cn
124.238.254.113        www.sekart.cn
124.238.254.113        sekart.cn
124.238.254.113        www.11309988.com
124.238.254.113        www.12100088.com
124.238.254.113        www.12108899.com
124.238.254.113        d2.llsging.com
124.238.254.113            llsging.com
124.238.254.113        dd.749571.com
124.238.254.113            749571.com
124.238.254.113        pr.749571.com
124.238.254.113            txwm1204.com
124.238.254.113        www.txwm1204.com



利用SRE修复IFEO劫持（删除下列选项）

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rpt.exe]
    <IFEO[360rpt.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
    <IFEO[360Safe.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
    <IFEO[360tray.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ACKWIN32.EXE]
    <IFEO[ACKWIN32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ANTI-TROJAN.EXE]
    <IFEO[ANTI-TROJAN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\APVXDWIN.EXE]
    <IFEO[APVXDWIN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\asktao.mod]
    <IFEO[asktao.mod]><C:\WINDOWS\Fonts\system\wdlm.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AUTODOWN.EXE]
    <IFEO[AUTODOWN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCONSOL.EXE]
    <IFEO[AVCONSOL.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVE32.EXE]
    <IFEO[AVE32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGCTRL.EXE]
    <IFEO[AVGCTRL.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVKSERV.EXE]
    <IFEO[AVKSERV.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVNT.EXE]
    <IFEO[AVNT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP.EXE]
    <IFEO[AVP.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVP32.EXE]
    <IFEO[AVP32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPCC.EXE]
    <IFEO[AVPCC.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPDOS32.EXE]
    <IFEO[AVPDOS32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPM.EXE]
    <IFEO[AVPM.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPTC32.EXE]
    <IFEO[AVPTC32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVPUPD.EXE]
    <IFEO[AVPUPD.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVSCHED32.EXE]
    <IFEO[AVSCHED32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWIN95.EXE]
    <IFEO[AVWIN95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVWUPD32.EXE]
    <IFEO[AVWUPD32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKD.EXE]
    <IFEO[BLACKD.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BLACKICE.EXE]
    <IFEO[BLACKICE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIADMIN.EXE]
    <IFEO[CFIADMIN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFIAUDIT.EXE]
    <IFEO[CFIAUDIT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET.EXE]
    <IFEO[CFINET.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CFINET32.EXE]
    <IFEO[CFINET32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95.EXE]
    <IFEO[CLAW95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLAW95CF.EXE]
    <IFEO[CLAW95CF.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER.EXE]
    <IFEO[CLEANER.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLEANER3.EXE]
    <IFEO[CLEANER3.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95.EXE]
    <IFEO[DVP95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DVP95_0.EXE]
    <IFEO[DVP95_0.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ECENGINE.EXE]
    <IFEO[ECENGINE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EGHOST.EXE]
    <IFEO[EGHOST.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ESAFE.EXE]
    <IFEO[ESAFE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EXPWATCH.EXE]
    <IFEO[EXPWATCH.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-AGNT95.EXE]
    <IFEO[F-AGNT95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT.EXE]
    <IFEO[F-PROT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-PROT95.EXE]
    <IFEO[F-PROT95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\F-STOPW.EXE]
    <IFEO[F-STOPW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FESCUE.EXE]
    <IFEO[FESCUE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FINDVIRU.EXE]
    <IFEO[FINDVIRU.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FP-WIN.EXE]
    <IFEO[FP-WIN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FPROT.EXE]
    <IFEO[FPROT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FRW.EXE]
    <IFEO[FRW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMAPP.EXE]
    <IFEO[IAMAPP.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IAMSERV.EXE]
    <IFEO[IAMSERV.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMASN.EXE]
    <IFEO[IBMASN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IBMAVSP.EXE]
    <IFEO[IBMAVSP.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOAD95.EXE]
    <IFEO[ICLOAD95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICLOADNT.EXE]
    <IFEO[ICLOADNT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICMON.EXE]
    <IFEO[ICMON.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPP95.EXE]
    <IFEO[ICSUPP95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ICSUPPNT.EXE]
    <IFEO[ICSUPPNT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IFACE.EXE]
    <IFEO[IFACE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IOMON98.EXE]
    <IFEO[IOMON98.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
    <IFEO[Iparmor.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\JEDI.EXE]
    <IFEO[JEDI.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe]
    <IFEO[KAV32.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVPFW.EXE]
    <IFEO[KAVPFW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVsvc.exe]
    <IFEO[KAVsvc.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSvcUI.exe]
    <IFEO[KAVSvcUI.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVFW.EXE]
    <IFEO[KVFW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.exe]
    <IFEO[KVMonXP.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp]
    <IFEO[KVMonXP.kxp]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVSrvXP.exe]
    <IFEO[KVSrvXP.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVwsc.exe]
    <IFEO[KVwsc.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp]
    <IFEO[KvXP.kxp]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchUI.EXE]
    <IFEO[KWatchUI.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOCKDOWN2000.EXE]
    <IFEO[LOCKDOWN2000.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo1_.exe]
    <IFEO[Logo1_.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Logo_1.exe]
    <IFEO[Logo_1.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LOOKOUT.EXE]
    <IFEO[LOOKOUT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LUALL.EXE]
    <IFEO[LUALL.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MAILMON.EXE]
    <IFEO[MAILMON.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MOOLIVE.EXE]
    <IFEO[MOOLIVE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MPFTRAY.EXE]
    <IFEO[MPFTRAY.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\my.exe]
    <IFEO[my.exe]><C:\WINDOWS\Fonts\system\lmmh.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\N32SCANW.EXE]
    <IFEO[N32SCANW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapsvc.exe]
    <IFEO[Navapsvc.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Navapw32.exe]
    <IFEO[Navapw32.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVLU32.EXE]
    <IFEO[NAVLU32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVNT.EXE]
    <IFEO[NAVNT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.EXE]
    <IFEO[navw32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NAVWNT.EXE]
    <IFEO[NAVWNT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NISUM.EXE]
    <IFEO[NISUM.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NMain.exe]
    <IFEO[NMain.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NORMIST.EXE]
    <IFEO[NORMIST.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NUPGRADE.EXE]
    <IFEO[NUPGRADE.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NVC95.EXE]
    <IFEO[NVC95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVCL.EXE]
    <IFEO[PAVCL.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVSCHED.EXE]
    <IFEO[PAVSCHED.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PAVW.EXE]
    <IFEO[PAVW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCCWIN98.EXE]
    <IFEO[PCCWIN98.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PCFWALLICON.EXE]
    <IFEO[PCFWALLICON.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PERSFW.EXE]
    <IFEO[PERSFW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.EXE]
    <IFEO[PFW.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Play.exe]
    <IFEO[Play.exe]><C:\WINDOWS\Fonts\system\lmmy.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe]
    <IFEO[Rav.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7.EXE]
    <IFEO[RAV7.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAV7WIN.EXE]
    <IFEO[RAV7WIN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmon.exe]
    <IFEO[RAVmon.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVmonD.exe]
    <IFEO[RAVmonD.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAVtimer.exe]
    <IFEO[RAVtimer.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rising.exe]
    <IFEO[Rising.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SAFEWEB.EXE]
    <IFEO[SAFEWEB.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN32.EXE]
    <IFEO[SCAN32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCAN95.EXE]
    <IFEO[SCAN95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCANPM.EXE]
    <IFEO[SCANPM.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SCRSCAN.EXE]
    <IFEO[SCRSCAN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SERV95.EXE]
    <IFEO[SERV95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMC.EXE]
    <IFEO[SMC.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SPHINX.EXE]
    <IFEO[SPHINX.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SWEEP95.EXE]
    <IFEO[SWEEP95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBSCAN.EXE]
    <IFEO[TBSCAN.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TCA.EXE]
    <IFEO[TCA.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-98.EXE]
    <IFEO[TDS2-98.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TDS2-NT.EXE]
    <IFEO[TDS2-NT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\THGUARD.EXE]
    <IFEO[THGUARD.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanHunter.exe]
    <IFEO[TrojanHunter.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VET95.EXE]
    <IFEO[VET95.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VETTRAY.EXE]
    <IFEO[VETTRAY.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSCAN40.EXE]
    <IFEO[VSCAN40.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSECOMR.EXE]
    <IFEO[VSECOMR.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSHWIN32.EXE]
    <IFEO[VSHWIN32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VSSTAT.EXE]
    <IFEO[VSSTAT.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WEBSCANX.EXE]
    <IFEO[WEBSCANX.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WFINDV32.EXE]
    <IFEO[WFINDV32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZONEALARM.EXE]
    <IFEO[ZONEALARM.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVP32.EXE]
    <IFEO[_AVP32.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPCC.EXE]
    <IFEO[_AVPCC.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_AVPM.EXE]
    <IFEO[_AVPM.EXE]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\修复工具.exe]
    <IFEO[修复工具.exe]><C:\WINDOWS\Fonts\system\ati2evxx.exe>  []


最后别忘记把病毒备份的东西压缩发送给我，邮箱：1987noodle0158@sina.com

如果备份文件不成功，能备份多少就是多少吧！
还有C:\ntldr.exe文件一定要备份出来，样本文件，我要做病毒试验用。看看修改了多少注册表