和我处理的这个一样：
如果有疑问，请扫日志来
运行SRENG
删除启动项注册表：
<EXPLORER><C:\Program Files\Common Files\System\wab32res.exe> [N/A]
<6z6lfq1rlid5iq2><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe> []
<h><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe> []
<y4bixb2qymdcb><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1explore.exe> []
<qmz48c78><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe> []
<wi5mrdz76fmjm><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe> []
<iq9dhfg04><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe> []
<t1078j9j9g3><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<twin><C:\WINDOWS\system32\twunk32.exe> []
删除服务：
[IPSEC Client / DATEING][Stopped/Auto Start]
<C:\WINDOWS\SYSTEM32\RUNDLL32.EXE C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL,Export 1087><N/A>
[TomDemoService / TomDemoService][Running/Auto Start]
<C:\CONFIG.EXE><N/A>
[Windows DHCP Service / WinDHCPsvc][Stopped/Auto Start]
<C:\WINDOWS\system32\rundll32.exe windhcp.ocx,start><Microsoft Corporation>
[WinFYService / WinFYService][Stopped/Auto Start]
<C:\WINDOWS\system32\RAVFY.EXE><N/A>
[WinWLService / WinWLService][Stopped/Auto Start]
<C:\WINDOWS\system32\RAVWL.EXE><N/A>
备份删除驱动：[vczfuo6 / vczfuo64][Running/Boot Start]
<\SystemRoot\System32\DRIVERS\vczfuo64.sys><N/A>
删除文件：C:\WINDOWS\system32\mppds.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav20.dll
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy1.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Gjzo0.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rav30.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fyzo0.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Msxo0.dll] [N/A, ]
[C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\LgSy0.dll
C:\Program Files\Common Files\System\wab32res.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\crasos.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1explore.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Servere.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\c0nime.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winlog0n.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\rundl132.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\SYSTEM32\WBEM\SMTPCONFS.DLL
C:\CONFIG.EXE
C:\WINDOWS\system32\windhcp.ocx
C:\WINDOWS\system32\RAVFY.EXE
C:\WINDOWS\system32\RAVWL.EXE
