[PID: 128][C:\WINDOWS\system32\svchosts.exe]  [N/A, N/A]
[PID: 356][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 604][C:\WINDOWS\system32\svchost.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 680][C:\WINDOWS\system32\wdfmgr.exe]  [Microsoft Corporation, 5.2.3790.1230 built by: dnsrv(bld4act)]
[PID: 1744][C:\WINDOWS\System32\alg.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[PID: 3824][C:\Program Files\Rising\Rav\RavTask.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 3860][C:\Program Files\Rising\Rav\Ravmon.exe]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
    [C:\Program Files\Rising\Rav\RsGuiLib.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 33]
    [C:\Program Files\Rising\Rav\BWList.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 10]
    [C:\Program Files\Rising\Rav\RSAPPMGR.DLL]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 2]
    [C:\Program Files\Rising\Rav\CfgDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 13]
    [C:\Program Files\Rising\Rav\RSCOMMON.DLL]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 5]
    [C:\Program Files\Rising\Rav\RsCommX.dll]  [rising, 18, 0, 0, 1]
    [C:\Program Files\Rising\Rav\RsXML.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 2]
    [C:\Program Files\Rising\Rav\PngDll.dll]  [Beijing Rising Technology Co., Ltd., 18, 0, 0, 5]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 3880][C:\WINDOWS\system32\ctfmon.exe]  [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 804][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 2660][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 2156][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 2204][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
    [C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys]  [N/A, N/A]
[PID: 1212][D:\llq\Maxthon\Maxthon.exe]  [Maxthon International Ltd., 1, 5, 6, 42]
    [D:\llq\Maxthon\maxzlib.dll]  [ , 1, 0, 0, 2]
    [D:\webxl\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [D:\llq\Maxthon\Services\RealTime\real_time.dll]  [, 1, 0, 0, 1]
    [C:\WINDOWS\system32\Macromed\Flash\Flash9.ocx]  [Adobe Systems, Inc., 9,0,16,0]
[PID: 2184][C:\WINDOWS\explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:\WINDOWS\system32\jsefusf.dll]  [Microsoft Corporation, N/A]
    [D:\webxl\WebThunderBHO_016.dll]  [Thunder Networking Technologies,LTD, 6, 0, 0, 5]
    [d:\adobe\Reader\ActiveX\AcroIEHelper.dll]  [Adobe Systems Incorporated, 6.0.0.2003051500]
    [D:\迅雷5\ComDlls\XunLeiBHO_007.dll]  [Thunder Networking Technologies,LTD, 5, 0, 1, 4]
    [C:\WINDOWS\system32\RavExt.dll]  [Beijing Rising Technology Co., Ltd., 19, 0, 0, 9]
[PID: 3796][C:\WINDOWS\system32\ffudf.exe]  [N/A, N/A]
[PID: 1952][C:\Program Files\WinRAR\WinRAR.exe]  [N/A, N/A]
[PID: 2424][C:\DOCUME~1\new\LOCALS~1\Temp\Rar$EX00.797\SREng.EXE]  [Smallfrogs Studio, 2.3.13.690]

==================================
文件关联
.TXT  OK. [%SystemRoot%\system32\NOTEPAD.EXE %1]
.EXE  OK. ["%1" %*]
.COM  OK. ["%1" %*]
.PIF  OK. ["%1" %*]
.REG  OK. [regedit.exe "%1"]
.BAT  OK. ["%1" %*]
.SCR  OK. ["%1" /S]
.CHM  OK. ["C:\WINDOWS\hh.exe" %1]
.HLP  OK. [%SystemRoot%\System32\winhlp32.exe %1]
.INI  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.INF  OK. [%SystemRoot%\System32\NOTEPAD.EXE %1]
.VBS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.JS  OK. [%SystemRoot%\System32\WScript.exe "%1" %*]
.LNK  OK. [{00021401-0000-0000-C000-000000000046}]

==================================
Winsock 提供者
N/A

==================================
Autorun.inf
N/A

==================================
HOSTS 文件
127.0.0.1      localhost
127.0.0.1    test.nicemm.cn
127.0.0.1    new3.etsoft.com.cn
127.0.0.1    www.djdj110.com
127.0.0.1    www.gaodumm.com
127.0.0.1    www.88cc8.com
127.0.0.1    wg770.com
127.0.0.1    www.y988.com
127.0.0.1    ads.9168a.com
127.0.0.1    www.flashsky.com

==================================
API HOOK
N/A

==================================


[/CODE]

引用:

【姑苏残月的贴子】<{285208E6-072D-2052-1107-030328030056}><"C:\Program Files\Common Files\{285208E6-072D-2052-1107-030328030056}\Update.exe" te-110-12-0000338> [N/A] <wWinlogin><C:\DOCUME~1\new\LOCALS~1\Temp\wkernel33.exe> [N/A] <main><rundll32.exe "C:\program files\internet explorer\use18.dll" mymain> [N/A] <{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys> [N/A] <WinlogonNotify: sclgntfys><C:\WINDOWS\sclgntfys.dll> [N/A] <C:\WINDOWS\system32\50D1F92C.EXE -service><Microsoft Corporation> <system32\DRIVERS\secdrv.sys><N/A> [C:\WINDOWS\sclgntfys.dll] [N/A, N/A] [C:\WINDOWS\system32\jsefusf.dll] [Microsoft Corporation, N/A] 差不多了,进程中还有几个,先关掉再说吧. ………………

怎么说你啊，哈哈哈哈，不是我说，你真的需要实践经验，说实话，这里面有些病毒很好删除，而有一些就需要用冰刃，还要用建立文件夹的方法防治病毒恢复

【回复“UFO不幸外人”的帖子】能详细指点我一下吗?谢谢先