[PID: 1472][C:\Program Files\Common Files\Sogou PXP\p2psvr.exe]  [Sohu.com Inc., 2, 0, 0, 26]
    [C:\Program Files\Sogou PXP\vodsvr.dll]  [Sohu.com Inc., 2, 0, 0, 24]
    [C:\Program Files\Sogou PXP\pxpnet.dll]  [Sohu.com Inc., 1, 0, 0, 3]
    [C:\Program Files\Sogou PXP\p2pclient.dll]  [Sohu.com Inc., 2, 1, 0, 2]
[PID: 1832][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 1992][C:\WINDOWS\system32\devgt.exe]  [Microsoft, 1.00]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
[PID: 192][C:\WINDOWS\Explorer.EXE]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\Program Files\Common Files\Autodesk Shared\AcSignCore16.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll]  [Adobe Systems, Inc., 7.0.0.0]
    [C:\WINDOWS\system32\igfxpph.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\igfxress.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [D:\TDDownload\EWIDO3.5\shellhook.dll]  [N/A, N/A]
[PID: 388][C:\Program Files\CNNIC\Cdn\cdnup.exe]  [CNNIC, 2, 5, 0, 6]
    [C:\Program Files\CNNIC\Cdn\cdnuplib.dll]  [CNNIC, 2, 5, 0, 6]
    [C:\Program Files\CNNIC\Cdn\cdnprh.dll]  [CNNIC, 2, 4, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdntdns.dll]  [CNNIC, 2, 2, 0, 3]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 440][C:\WINDOWS\system32\Media\winlogon.exe]  [N/A, N/A]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
[PID: 460][C:\WINDOWS\system32\wscntfy.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 544][c:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 4, 0, 0, 52]
    [c:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 23]
    [c:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 4]
    [c:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
[PID: 812][C:\WINDOWS\system32\conime.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]

[C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 920][C:\PROGRA~1\svhost32.exe]  [N/A, N/A]
    [C:\DOCUME~1\first\LOCALS~1\Temp\wuefbby2.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
[PID: 1560][C:\WINDOWS\system32\hkcmd.exe]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\hccutils.DLL]  [Intel Corporation, 3.0.0.4299]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\system32\igfxres.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 1948][C:\WINDOWS\system32\igfxpers.exe]  [Intel Corporation, 3.0.0.4299]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\igfxsrvc.dll]  [Intel Corporation, 3.0.0.4299]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 2296][C:\Program Files\Microsoft\svhost32.exe]  [N/A, N/A]
    [C:\DOCUME~1\first\LOCALS~1\Temp\sh9.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
[PID: 2320][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 2332][C:\WINDOWS\down\rundll32.exe]  [N/A, N/A]
    [C:\DOCUME~1\first\LOCALS~1\Temp\2rzxlu.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 2476][C:\WINDOWS\system32\explore3.exe]  [Microsoft Corporation, 5.00.2195.6601]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 2588][C:\program files\internet explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\winsys32_061130.dll]  [N/A, N/A]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdnuplib.dll]  [CNNIC, 2, 5, 0, 6]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
[PID: 3912][D:\TDDownload\EWIDO3.5\securitysuite.exe]  [ewido networks, 3, 5, 0, 0]
    [D:\TDDownload\EWIDO3.5\lang.dll]  [privat, 1, 0, 0, 1]
    [D:\TDDownload\EWIDO3.5\wizard.dll]  [N/A, N/A]
    [D:\TDDownload\EWIDO3.5\framework.dll]  [ewido networks, 1, 0, 0, 249]
    [D:\TDDownload\EWIDO3.5\configuration.dll]  [ewido networks, 1, 0, 0, 1]
    [D:\TDDownload\EWIDO3.5\engine.dll]  [ewido networks GmbH & Co. KG, 4, 0, 0, 2]
    [D:\TDDownload\EWIDO3.5\scan.dll]  [ewido networks, 1, 0, 0, 2]
    [D:\TDDownload\EWIDO3.5\modules\autostartviewer.dll]  [ewido networks, 1, 0, 0, 114]
    [D:\TDDownload\EWIDO3.5\TScan1.dll]  [ewido networks, 3, 0, 0, 0]
    [D:\TDDownload\EWIDO3.5\archive.dll]  [N/A, N/A]
    [D:\TDDownload\EWIDO3.5\modules\connectionwatch.dll]  [ewido networks, 1, 0, 0, 2]
    [D:\TDDownload\EWIDO3.5\modules\processviewer.dll]  [privat, 1, 0, 0, 2]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [D:\TDDownload\EWIDO3.5\quarantine.dll]  [ewido networks, 1, 0, 0, 43]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [D:\TDDownload\EWIDO3.5\update.dll]  [ewido networks, 1, 0, 0, 8]
    [D:\TDDownload\EWIDO3.5\update_core.dll]  [N/A, N/A]
    [D:\TDDownload\EWIDO3.5\info.dll]  [ewido networks, 1, 0, 0, 137]
    [D:\TDDownload\EWIDO3.5\resources.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]

[PID: 1092][C:\Program Files\Internet Explorer\iexplore.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdnuplib.dll]  [CNNIC, 2, 5, 0, 6]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 7.0.7.2006011200]
    [C:\PROGRA~1\CNNIC\Cdn\cdndrag.dll]  [CNNIC, 1.0.0.6]
    [C:\PROGRA~1\cdnpack\cdncn.dll]  [CNNIC, 1, 0, 0, 7]
    [C:\Program Files\Tencent\QQ\QQIEHelper.dll]  [深圳市腾讯计算机系统有限公司, 1, 1, 0, 5]
    [C:\WINDOWS\system32\AdPutHelper.dll]  [system, 1.00]
    [C:\Program Files\Thunder Network\Thunder\ComDlls\XunLeiBHO_002.dll]  [Thunder Networking Technologies,LTD, 5, 0, 0, 2]
    [C:\PROGRA~1\CNNIC\Cdn\wmhlpr.dll]  [CNNIC, 1, 1, 0, 0]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
[PID: 2384][C:\Program Files\Thunder Network\Thunder\Program\Thunder5.exe]  [Thunder Networking Technologies,LTD, 5.4.0.226]
    [C:\Program Files\Thunder Network\Thunder\Program\UpdateDownload.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 8]
    [C:\Program Files\Thunder Network\Thunder\Program\download_interface.dll]  [Thunder Networking Technologies,LTD, 2, 0, 0, 1]
    [C:\Program Files\Thunder Network\Thunder\Program\stlport_vc646.dll]  [STLport Consulting, Inc., 4.6.2003.1031]
    [C:\Program Files\Thunder Network\Thunder\Program\log4cplus.dll]  [, 1, 0, 2, 1]
    [C:\Program Files\Thunder Network\Thunder\Program\asyn_dns.dll]  [N/A, N/A]
    [C:\Program Files\Thunder Network\Thunder\Program\msgmanage.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 15]
    [C:\Program Files\Thunder Network\Thunder\Program\historyinfo_manage.dll]  [Thunder Networking Technologies,LTD, 5, 2, 0, 148]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\Program Files\Thunder Network\Thunder\Program\RegisterDll.dll]  [Thunder Networking Technologies,LTD, 2, 1, 0, 18]
    [C:\Program Files\Thunder Network\Thunder\Program\FloatBar.dll]  [Thunder Networking Technologies,LTD, 1, 0, 0, 2]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\Program Files\Thunder Network\Thunder\Plugins\TingTing\TingTing.dll]  [Thunder Networking Technologies,LTD, 1, 1, 1, 9]
    [C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbedShell.dll]  [　, 1, 0, 0, 11]

[C:\Program Files\Thunder Network\Thunder\Components\InMedia\iEmbed04.dll]  [　, 2, 3, 0, 37]
    [C:\Program Files\Thunder Network\Thunder\Components\P4PClient\P4PClient.dll]  [Thunder Networking Technologies,LTD, 1, 0, 4, 10]
    [D:\TDDownload\EWIDO3.5\shellhook.dll]  [N/A, N/A]
    [C:\Program Files\Thunder Network\Thunder\Program\iTargetAd.dll]  [Thunder Networking Technologies,LTD, 1, 0, 1, 59]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scr_ch_pg.dll]  [Kaspersky Lab, 1.0.6.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\klscav.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\pr_remote.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prloader.dll]  [Kaspersky Lab, 6.0.0.299]
    [C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\prkernel.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\params.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\pxstub.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\tempfile.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\nfio.ppl]  [Kaspersky Lab, 6.0.0.299]
    [c:\program files\kaspersky lab\kaspersky anti-virus 6.0\fsdrvplgn.ppl]  [Kaspersky Lab, 6.0.0.299]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
[PID: 1896][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\system32\AcSignIcon.dll]  [Autodesk, 16.0.0.86]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]
[PID: 2156][C:\DOCUME~1\first\LOCALS~1\Temp\Rar$EX01.859\SREng\SREng.exe]  [Smallfrogs Studio, 2.2.6.605]
    [C:\Program Files\CNNIC\Cdn\imaoe.dll]  [CNNIC, 2, 2, 0, 1]
    [C:\Program Files\CNNIC\Cdn\cdnforie.dll]  [CNNIC, 2, 1, 0, 3]
    [C:\Program Files\CNNIC\Cdn\cdndet.dll]  [CNNIC, 2, 5, 0, 0]
    [C:\WINDOWS\tdll.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dms.dll]  [N/A, N/A]
    [C:\WINDOWS\system32\dllwm.dll]  [N/A, N/A]

=================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  Error. [AutoCADScriptFile]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
[D:\]
[autorun]
open=d:\myplay.pif

==================================
HOSTS 文件
N/A

==================================

运行SREng2,使用“启动项目”－－注册表－－删除
C:\WINDOWS\system32\explore3.exe
C:\PROGRA~1\svhost32.exe
C:\Program Files\Microsoft\svhost32.exe
C:\WINDOWS\down\rundll32.exe
C:\WINDOWS\rund1132.exe
C:\PROGRA~1\TENCENT\Adplus\stup.exe C:\PROGRA~1\TENCENT\Adplus\Adplus.dll
C:\DOCUME~1\first\LOCALS~1\Temp\okads059.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon]
<shell><Explorer.exe> [(Verified)Microsoft Corporation]
<Userinit><C:\WINDOWS\system32\userinit.exe,devgt.exe,rundll32.exe C:\WINDOWS\system32\winsys16_061130.dll start>
红色的不要

运行(双击)SRENG2，点“启动项目，服务，点“Win32服务应用程序”
勾选“隐藏微软服务”选中病毒服务
83CD359E
，选择“删除服务”
点“设置”选择“否”
重启按F８进入安全模式下
显示隐藏文件
删除：     
C:\WINDOWS\system32\83CD359E.EXE
devgt.exe
C:\WINDOWS\system32\winsys16_061130.dll
C:\WINDOWS\system32\explore3.exe
C:\PROGRA~1\svhost32.exe
C:\Program Files\Microsoft\svhost32.exe
C:\WINDOWS\down\rundll32.exe
C:\WINDOWS\rund1132.exe
C:\PROGRA~1\TENCENT\Adplus\stup.exe C:\PROGRA~1\TENCENT\Adplus\Adplus.dll
C:\DOCUME~1\first\LOCALS~1\Temp\清空文件夹
:\WINDOWS\system32\dllwm.dll和C:\WINDOWS\tdll.dll
C:\WINDOWS\system32\dms.dll] [N/A, N/A]
[C:\WINDOWS\system32\dllwm.dll] [N/A,

右键打开,不要双击,删除D盘的隐藏文件
d:\Autorun.inf
d:\myplay.pif

杀了N次终于搞定了  谢谢 红夜鬼