1sass.exe,winnet.sys,2pwsdor.sys,k87wovjoq.sys virus Removal _ virus killing

A classmate for help. U disk poisoning infected machine, resulting in the open "My Computer" can not see any disk partitions, and the system card to suspended animation state.

First, the AutoPlay feature is turned off by Group Policy. Insert a U disk.
Implementation: Start-run-browse, find the corresponding U disk partition, copy IceSword and Sreng.

Change the name of the IceSword software, change the name to any name, double-click, the System blue screen automatically restart. Stuck in the BIOS screen. Press the restart key still, then disconnect the host power for a moment, then open the function of normal entry.

Sreng Scan log, found the following suspicious content:
==================================
　　
Quote:
Service
[Rising Protected Storage/risieg] [Running/auto Start]
<C:\WINDOWS\system\1sass.exe><N/A>

==================================
Driver Program
[2pwsdo/2pwsdor] [Stopped/boot Start]
<\SystemRoot\System32\DRIVERS\2pwsdor.sys><N/A>
[K87wovjoq/k87wovjoq] [Running/auto Start]
<\?? \c:\windows\system32\drivers\k87wovjoq.sys><n/a>
[Winnet/winnet] [Running/manual Start]
<\?? \c:\windows\system32\winnet.sys><n/a>

==================================
Browser add-ins
　　
Quote:
[] {66ae1fc9-7feb-499f-99c3-147e62121115} <c:\windows\system32\xswfgklsjnspp.dll, >


Resolution process:
Use the Trojan Horse brute force removal to remove the following files:
　　
Quote:
C:\WINDOWS\system\1sass.exe
C:\WINDOWS\System32\DRIVERS\2pwsdor.sys
C:\WINDOWS\system32\drivers\k87wovjoq.sys
C:\WINDOWS\system32\xswfgklsjnspp.dll


and use Sreng to remove the corresponding service items and drivers, as follows:
－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
Start Project-> service-> Win32 Service Application-> Select Hide Microsoft Services and delete the following name:
　　
Quote:
[Rising Protected Storage/risieg] [Running/auto Start]
<C:\WINDOWS\system\1sass.exe><N/A>

－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－－
"Start Project-> service-> driver-> Remove the following drivers:
[2pwsdo/2pwsdor] [Stopped/boot Start]
<\SystemRoot\System32\DRIVERS\2pwsdor.sys><N/A>
[K87wovjoq/k87wovjoq] [Running/auto Start]
<\?? \c:\windows\system32\drivers\k87wovjoq.sys><n/a>
[Winnet/winnet] [Running/manual Start]
<\?? \c:\windows\system32\winnet.sys><n/a>


Run IceSword again, everything is OK, delete each partition of the Auto class virus file (name forgotten)
Clean IE cache, the rest is to kill soft scan.

Tips:
The above driver files and IE add-in files may be randomly named for reference only.