[H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [H:\Program Files\WinRAR\rarext.dll]  [N/A, N/A]
    [H:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1396][H:\WINDOWS\system32\spoolsv.exe]  [Microsoft Corporation, 5.1.2600.0 (XPClient.010817-1148)]
    [H:\WINDOWS\System32\spool\PRTPROCS\W32X86\vprproc.dll]  [Windows (R) 2000 DDK provider, 5.00.2195.1620]
[PID: 1484][H:\Program Files\Rising\Rav\RavStub.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 4]
    [H:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [H:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
[PID: 1564][H:\WINDOWS\System32\svchost.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [H:\Program Files\Common Files\System\MS5BD752.DLL]  [N/A, N/A]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1632][h:\program files\rising\rfw\RfwMain.exe]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 70]
    [h:\program files\rising\rfw\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 31]
    [h:\program files\rising\rfw\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [h:\program files\rising\rfw\RfwCtrl.dll]  [Beijing Rising Technology Co., Ltd., 5, 0, 0, 11]
    [h:\program files\rising\rfw\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [h:\program files\rising\rfw\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1732][H:\WINDOWS\SOUNDMAN.EXE]  [Realtek Semiconductor Corp., 5.0.19]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1800][H:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [H:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [H:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [H:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [H:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1824][H:\Program Files\Rising\AntiSpyware\runiep.exe]  [Beijing Rising Technology Co., Ltd., 1, 0, 1, 4]
    [H:\Program Files\Rising\AntiSpyware\iep_ctrl.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 4]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
[PID: 1828][H:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [H:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [H:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [H:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [H:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [H:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [H:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [H:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [H:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1944][H:\WINDOWS\System32\nvsvc32.exe]  [NVIDIA Corporation, 6.14.10.4403]
[PID: 1984][H:\WINDOWS\SYSTEM32\RUNDLL32.EXE]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
[PID: 2000][H:\WINDOWS\System32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.0 (xpclient.010817-1148)]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 1160][H:\WINDOWS\System32\wuauclt.exe]  [Microsoft Corporation, 5.8.0.2469 built by: lab01_n(wmbla)]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[PID: 3980][H:\Program Files\Internet Explorer\IEXPLORE.EXE]  [Microsoft Corporation, 6.00.2600.0000 (xpclient.010817-1148)]
    [H:\360safe\safemon\safemon.dll]  [, 1, 0, 0, 1002]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\SUPERR~1\MagicSet\haokanbar.dll]  [Xiang Feng Technology, 2, 2, 0, 1612]
    [H:\Thunder Network\WebThunder\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [H:\BitComet\tools\BitCometBHO.dll]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
    [H:\WINDOWS\System32\Macromed\Flash\Flash9b.ocx]  [Adobe Systems, Inc., 9,0,28,0]
    [H:\Thunder Network\Thunder\Components\InMedia\MediaAddin11.dll]  [Thunder Networking Technologies,LTD, 3, 1, 0, 63]
    [H:\WINDOWS\System32\dxmasf.dll]  [N/A, N/A]
    [H:\Ringz Studio\Storm Codec\Codecs\VSFilter.dll]  [Gabest, 1, 0, 1, 3]
    [H:\WINDOWS\System32\ffdshow.ax]  [N/A, 1.0.2.2028]
    [H:\WINDOWS\System32\msdmo.dll]  [N/A, N/A]
    [H:\Ringz Studio\Storm Codec\Codecs\TTL2Dec.dll]  [N/A, N/A]
    [H:\Ringz Studio\Storm Codec\Codecs\Vid1Dec.dll]  [N/A, N/A]
[PID: 2540][H:\DOCUME~1\kaixin\LOCALS~1\Temp\Rar$EX00.313\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]
    [H:\Program Files\5BD7527A\14021C57.DLL]  [N/A, N/A]
    [H:\Program Files\Rising\AntiSpyware\ieprot.dll]  [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]

==================================
文件关联
.TXT  Error. [H:\WINDOWS\notepad.exe %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["H:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
N/A

==================================
API HOOK
N/A

==================================


[/CODE]

运行SRENG删除启动项注册表：
<NeroCheck><H:\WINDOWS\System32\NeroCheck.exe> [Ahead Software Gmbh]这个请确认是否是你自己安装的
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{5BD7527A-A6FF-11E0-9A84-00C04FD8DBD8}><H:\WINDOWS\System32\HBD7527A.log> [N/A]
运行SRENG删除服务：
[Remote Registry Protect / Investor][Running/Auto Start]
<H:\WINDOWS\System32\svchost.exe -k netsvcs-->H:\WINDOWS\System32\baptc.dll><Microsoft Corporation>
[Local Connection Manager / SOCEESe][Running/Auto Start]
<H:\WINDOWS\SYSTEM32\RUNDLL32.EXE H:\WINDOWS\SYSTEM32\WBEM\TMACN.DLL,Export 1087><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Disabled]
<H:\WINDOWS\System32\\rundll32.exe windhcp.ocx,input><Microsoft Corporation>

删除文件：
H:\WINDOWS\System32\NeroCheck.exe
H:\WINDOWS\System32\HBD7527A.log
H:\WINDOWS\System32\baptc.dll
H:\WINDOWS\System32\windhcp.ocx
H:\WINDOWS\System32\winlib .dll
H:\WINDOWS\SYSTEM32\WBEM\TMACN.DLL
H:\Program Files\5BD7527A\14021C57.DLL

以下备份后删除：
H:\WINDOWS\system32\drivers\fdcbfcba.sys
H:\WINDOWS\system32\drivers\ggdghghg.sys

开始-运行-regedit-搜索winlib .dll，搜索到的都删除

不用那么麻烦...新建一个文件夹,把它拉进去,连同文件夹一起删.今天刚好遇到这个东东.哈哈

引用:

【夜暮如斯的贴子】不用那么麻烦...新建一个文件夹,把它拉进去,连同文件夹一起删.今天刚好遇到这个东东.哈哈 ………………

病毒开启的服务项必须删除,否则无法彻底清除病毒
不是所有病毒只要删除就可以了的,如果你要是遇到那些有注册表守护的删除不了怎么半?
必须要这么做~~

不可以喔
有几个文件都找不到的，那个PCTOOL.dll(Trojan.Clicker.Agent.azl)还是杀不掉，连系统还原等功能都用不到啊