清理了一毒窩，基本上能中的全中了

最後那些病毒的屍體加起來就有30M，恐怖。害得我殺了一個工作日，好久不碰病毒，技藝生疏也。

能乾的壞事全乾了，能藏的位置全藏了。病毒主要藏身位置：
C:/ 系統硬碟根目錄下
C:/WINDOWS/
C:/WINDOWS/system
C:/windows/fonts
c:/windows/inf
C:/WINDOWS/system32/config/
C:/WINDOWS/system32
c:/windows/system32/drivers
C:/WINDOWS/system32/inf/
C:/WINDOWS/temp
c:/docume~1/admini~1/locals~1/temp/
C:/Documents and Settings/All Users/「開始」菜單/程式/啟動/
c:/program files/internet explorer/plugins/
C:/windows/Downloaded Program Files/
C:/WINDOWS/Help/
C:/Documents and Settings/Administrator/Local Settings/Temp
各個盤根目錄下，各個盤迴收站receycled目錄中
等等。

還有個乖乖的目錄 C:/runauto...
很多病毒表徵圖就採用檔案夾的表徵圖，勿混淆
C:/windows/zuoyu16.ini 是一個病毒的記錄，把其中記錄的檔案一一刪除

把檔案按照建立時間和修改時間排序，即可基本上把所有病毒體都找出來。

開啟C:/windows/system32/drivers/etc/hosts檔案（可用記事本、word等文字編輯器或文書處理軟體開啟），把其中的東西該刪除的刪除，如果不會，直接使用SREng把hosts檔案重設即可。

C:/ntldr.exe
C:/discovery.exe
C:/recycled/dc1.exe
C:/WINDOWS/SVIQ.EXE
C:/WINDOWS/system/Fun.exe
C:/WINDOWS/dc.exe
C:/WINDOWS/inf/Other.exe
C:/WINDOWS/system32/config/Win.exe
C:/WINDOWS/Fonts/cd8b366baadbfc0c4ab44b982b5c3781/system/soundma.exe
c:/program files/internet explorer/plugins/winsys8v.sys
C:/WINDOWS/system32/15b1.dll
C:/windows/Downloaded Program Files/461b.dll
C:/windows/Downloaded Program Files/15b.exe
C:/Program Files/Common Files/CPUSH/cpush.dll

下面的東西摘自SREng和Autoruns的掃描，有刪減，刪減過程中可能遺漏某些病毒，也可能勿寫非病毒檔案。

[HKEY_CURRENT_USER/Software/Microsoft/Windows/CurrentVersion/Run]
<dc2k5><C:/WINDOWS/SVIQ.EXE>  []
<Fun><C:/WINDOWS/system/Fun.exe>  []
<dc><C:/WINDOWS/dc.exe>  []
[HKEY_CURRENT_USER/Software/Microsoft/Windows NT/CurrentVersion/Windows]
<load><C:/WINDOWS/inf/Other.exe>  []
<run><C:/WINDOWS/system32/config/Win.exe>  []
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Run]
    <inudhya><C:/WINDOWS/Fonts/cd8b366baadbfc0c4ab44b982b5c3781/system/soundma.exe>  []
    <mfchlp32><C:/WINDOWS/mfchlp32.exe>  []
    <tciocp32><C:/WINDOWS/tciocp32.exe>  []
    <msccrt><C:/WINDOWS/msccrt.exe>  []
    <fmsbbqi><C:/WINDOWS/fmsbbqi.exe>  []
    <RavLoa><C:/WINDOWS/system32/RavLoa.exe>  []
    <TBMonEx><C:/WINDOWS/Fonts/cd8b366baadbfc0c4ab44b982b5c3781/system/>  [N/A]
    <DbgHlp32><C:/WINDOWS/DbgHlp32.exe>  []
    <SHAProc><C:/WINDOWS/SHAProc.exe>  []
    <igzwzslm><C:/WINDOWS/gwsmhxuq.exe>  []
    <PTSShell><C:/WINDOWS/PTSShell.exe>  []
    <WSockDrv32><C:/WINDOWS/WSockDrv32.exe>  []
    <AVPSrv><C:/WINDOWS/AVPSrv.exE>  []
    <upxdnd><C:/WINDOWS/upxdnd.exe>  []
    <LotusHlp><C:/WINDOWS/LotusHlp.exe>  []
    <cmdbcs><C:/WINDOWS/cmdbcs.exe>  []
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/RunOnce]
    <vymwvk44><%systemroot%/system32/Rundll32.exe %systemroot%/system32/vymwvk44.dll DllUnregisterServer>  [N/A]
[HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/CurrentVersion/Policies/Explorer/Run]
    <zuoyue><C:/WINDOWS/system32/inf/svch0st.exe C:/WINDOWS/system32/lwizysy16_080414.dll start>  [N/A]
    <zsmscc><rundll32.exe C:/WINDOWS/system32/mycc080201.dll mymain>  [N/A]
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Explorer/ShellExecuteHooks]
    <{AEB6717E-7E19-11d0-97EE-00C04FD91972}><shell32.dll>  [(Verified)Microsoft Windows Component Publisher]
    <{32CD708B-60A7-4C00-9377-D73EAA495F0F}><>  [N/A]
    <{6ce08af1-5f70-4c1a-8d1a-8aba11619e87}><C:/WINDOWS/system32/ayFKKFKK1055.dll>  []
    <{fe0ebc25-107f-4fda-ada3-7238573f90ad}><C:/WINDOWS/system32/ayJHVJHV1015.dll>  []
    <{734bfbb9-34f7-441c-b064-b3590bbe34ea}><C:/WINDOWS/system32/txWWQWWQ1006.dll>  []
    <{c4bf46a2-1c05-427d-992f-4e24f7d57f68}><C:/WINDOWS/system32/ttNNBNNB1047.dll>  []
    <{05922c2d-da84-48e8-a3e4-e797c58c39cf}><C:/WINDOWS/system32/ttEZZEZZ1046.dll>  []
    <{29fab913-d0cd-477b-a3f0-3d7c3a90379b}><C:/WINDOWS/system32/ttVUFVUF1011.dll>  []
    <{79dae25e-7bee-4484-bb1a-f30c45d535d9}><C:/WINDOWS/system32/ttQACQAC1035.dll>  []
    <{6167F471-EF2B-41DD-A5E5-C26ACDB5C096}><C:/Program Files/Internet Explorer/PLUGINS/WinSys8v.Sys>  []
    <{b669b098-7a40-42da-91f5-f3cadf9319e1}><C:/WINDOWS/system32/txRJHRJH1021.dll>  []
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Active Setup/Installed Components/Discoverr]
    <N/A><C:/WINDOWS/system32/Discovery.exe>  []
[HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Image File Execution Options/] 映像劫持
<C:/WINDOWS/system32/Discovery.exe> 和 <C:/xue.exe>劫持了一大堆的工具軟體，這倆還有競爭
==================================
開機檔案夾
[webspeed]
  <C:/Documents and Settings/All Users/「開始」菜單/程式/啟動/webspeed.exe -->  [N/A]><N>
==================================
服務
[DCOM Service Process Manager / DCOMManager][Stopped/Auto Start]
  <C:/WINDOWS/system32/svchost.exe -k netsvcs-->c:/windows/inf/pcidevices8.inf><Microsoft Corporation>
[Windows ptug RunThem / ptug][Stopped/Auto Start]
  <C:/WINDOWS/System32/svchost.exe -k netsvcs-->C:/PROGRA~1/kopb/uyzl.dll><>
[Remote Procedure Call System(RPCS) / RpcS][Stopped/Auto Start]
  <C:/WINDOWS/system32/RpcS.exe><Microsoft Corporation>
[Perfor and Alell / Transfer Service][Stopped/Auto Start]
  <C:/WINDOWS/system32/Transfer Sebvice.exe><N/A>
==================================
驅動程式
[cqit / cqit][Stopped/Auto Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp33.tmp><N/A>
[dohs / dohs][Stopped/Auto Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmpDF.tmp><N/A>
[fpids32 / fpids32][Stopped/Auto Start]
  </??/C:/WINDOWS/system32/drivers/msosfpids32.sys><N/A>
[iCafe Manager / iCafe Manager][Stopped/Manual Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/usbhcid.sys><N/A>
[kbrhqjlb / kbrhqjlb][Running/Boot Start]
  </SystemRoot//SystemRoot/System32/drivers/kbrhqjlb.sys><N/A>
[mhfp / mhfp][Stopped/Auto Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp258.tmp><N/A>
[mnsf / mnsf][Stopped/Auto Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp265.tmp><N/A>
[msfpfis64 / msfpfis64][Stopped/Auto Start]
  </??/C:/WINDOWS/system32/drivers/msosmsfpfis64.sys><N/A>
[ZTE USB / MX_98Drv][Stopped/Auto Start]
[NPF / NPF][Stopped/Manual Start]
  </??/C:/WINDOWS/system32/drivers/EF.tmp><N/A>
[npkcrypt / npkcrypt][Stopped/Auto Start]
  </??/C:/Program Files/QQ2006/npkcrypt.sys><N/A>
[ntptdb / ntptdb][Stopped/Auto Start]
  </??/C:/Documents and Settings/All Users/Application Data/Microsoft/Office/SYSTEM/ntptdb.sys><N/A>
[RESSDT / RESSDT][Stopped/Manual Start]
  </??/C:/WINDOWS/system32/ssdtdt.sys><N/A>
[Sc Manager / Sc Manager][Stopped/Manual Start]
  </??/C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/usbcams3.sys><N/A>
[vymwvk4 / vymwvk44][Running/Boot Start]
  </SystemRoot/System32/DRIVERS/vymwvk44.sys><N/A>
[kavell / kavell][Stopped/Manual Start]
  </??/C:/WINDOWS/system32/kavell.sys><N/A>
[PID: 956][C:/WINDOWS/Explorer.exe]  [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
    [C:/WINDOWS/system32/xbcvxb.dll]  [N/A, ]
    [C:/WINDOWS/system32/msepbe.dll]  [N/A, ]
    [C:/WINDOWS/system32/ayFKKFKK1055.dll]  [N/A, ]
    [C:/WINDOWS/system32/ayJHVJHV1015.dll]  [N/A, ]
    [C:/WINDOWS/system32/txWWQWWQ1006.dll]  [N/A, ]
    [C:/WINDOWS/system32/ttNNBNNB1047.dll]  [N/A, ]
    [C:/WINDOWS/system32/ttEZZEZZ1046.dll]  [N/A, ]
    [C:/WINDOWS/system32/ttVUFVUF1011.dll]  [N/A, ]
    [C:/WINDOWS/system32/ttQACQAC1035.dll]  [N/A, ]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys8v.Sys]  [N/A, ]
    [C:/WINDOWS/system32/txRJHRJH1021.dll]  [N/A, ]
[PID: 1140][C:/WINDOWS/SVIQ.EXE]  [, 1.00]
    [C:/WINDOWS/system32/xbcvxb.dll]  [N/A, ]
    [C:/WINDOWS/system32/msepbe.dll]  [N/A, ]
    [C:/Program Files/Internet Explorer/PLUGINS/WinSys8v.Sys]  [N/A, ]
[PID: 1188][C:/WINDOWS/dc.exe]  [, 1.00]
[PID: 1416][C:/WINDOWS/system/Fun.exe]  [, 1.00]
==================================
Autorun.inf
[C:/]
[AutoRun]
Open=Discovery.exe
Shell/Open=開啟(&O)
Shell/Open/Command=Discovery.exe
Shell/Open/Default=1
Shell/Explore=資源管理員(&X)
Shell/Explore/Command=Discovery.exe
==================================
進程特權掃描
特殊特權被允許： SeDebugPrivilege [PID = 1140, C:/WINDOWS/SVIQ.EXE]
特殊特權被允許： SeDebugPrivilege [PID = 1188, C:/WINDOWS/DC.EXE]
特殊特權被允許： SeDebugPrivilege [PID = 1416, C:/WINDOWS/SYSTEM/FUN.EXE]
[QQgame]
  <C:/Documents and Settings/All Users/「開始」菜單/程式/啟動/QQgame.exe -->  [N/A]><N>
==================================
瀏覽器附加元件
+ brush Class            File not found: c:/windows/system32/solid.dll
+ CAdLogic Object            c:/program files/common files/cpush/cpush.dll
+ HTML Doucment            File not found: C:/WINDOWS/system32/mseval.dll
+ Invoke Class            File not found: C:/WINDOWS/system32/15b1.dll
+ Windows Word            File not found: C:/WINDOWS/system32/newtn.dll
+ {989D2FEB-5411-4565-8988-1DD2C5263377}            File not found: C:/WINDOWS/system32/SysInfo.dll
HKLM/Software/Microsoft/Internet Explorer/Toolbar           
+ msdxm.ocx            File not found: C:/msdxm.ocx

HKLM/System/CurrentControlSet/Services
+ DCOMManager    管理 DCOM 服務載入功能，該服務不能被刪除。    Microsoft Corporation    c:/windows/inf/pcidevices8.inf
+ IPRIP            File not found: C:/WINDOWS/system32/wordms.dll
+ kkdc    在網域控制站上此服務啟用使用者使用 Kerberos 授權協議登入網路。如果此服務在網域控制站上被停用，使用者將無法登入網路。如果此服務被禁用，任何依賴於它的服務將無法啟用        File not found: C:/WINDOWS/lsass.exe
+ ms_2fax    Fax 2Client        File not found: C:/WINDOWS/system32/5b211.exe
+ ptug    網路管理服務，如果此服務被停止，有可能部分網路功能無法實現。        c:/program files/kopb/uyzl.dll
HKLM/System/CurrentControlSet/Services       
+ ALCXWDM            File not found: system32/drivers/ALCXWDM.SYS
+ cqit            File not found: C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp33.tmp
+ dohs            File not found: C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmpDF.tmp
+ mhfp            File not found: C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp258.tmp
+ mnsf            File not found: C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/tmp265.tmp
+ msfpfis64            c:/windows/system32/drivers/msosmsfpfis64.sys
+ NPF            File not found: C:/WINDOWS/system32/drivers/5A.tmp
+ npkcrypt            File not found: C:/Program Files/QQ2006/npkcrypt.sys
HKLM/Software/Microsoft/Command Processor/Autorun           
+ C:/WINDOWS/system32/sashost.exe            File not found: C:/WINDOWS/system32/sashost.exe
HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Windows/Appinit_Dlls           
+ atehhz.dllawef.dll            File not found: atehhz.dllawef.dll
+ m            File not found: m
+ msoscqit01.dll            c:/windows/system32/msoscqit01.dll
+ msosdohs00.dll            c:/windows/system32/msosdohs00.dll
+ msosmhfp00.dll            c:/windows/system32/msosmhfp00.dll
+ msosmnsf01.dll            c:/windows/system32/msosmnsf01.dll
+ msosping01.dll            c:/windows/system32/msosping01.dll
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/RunOnce           
+ eqaxsh54    Run a DLL as an App    Microsoft Corporation    c:/windows/system32/rundll32.exe
+ vymwvk44    Run a DLL as an App    Microsoft Corporation    c:/windows/system32/rundll32.exe
C:/Documents and Settings/All Users/「開始」菜單/程式/啟動           
+ Adobe Gamma Loader.lnk    Adobe Gamma Loader    Adobe Systems, Inc.    c:/program files/common files/adobe/calibration/adobe gamma loader.exe
+ qqgame.exe            c:/documents and settings/all users/「開始」菜單/程式/啟動/autorunsdisabled/qqgame.exe
+ webspeed.exe            c:/documents and settings/all users/「開始」菜單/程式/啟動/autorunsdisabled/webspeed.exe
HKCU/Software/Microsoft/Windows NT/CurrentVersion/Windows/Load           
+ C:/WINDOWS/inf/Other.exe            File not found: C:/WINDOWS/inf/Other.exe
HKCU/Software/Microsoft/Windows NT/CurrentVersion/Windows/Run           
+ C:/WINDOWS/system32/config/Win.exe            File not found: C:/WINDOWS/system32/config/Win.exe
HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Policies/Explorer/Run           
+ 011            File not found: C:/WINDOWS/system32/011.dll
+ 461b    Microsoft DirectMusic Interactive Engine    Microsoft Corporation    c:/windows/downloaded program files/461b.dll
+ zsmscc            File not found: C:/WINDOWS/system32/mycc080201.dll mymain
+ zsmscc            File not found: C:/WINDOWS/system32/mycc080201.dll mymain
+ zuoyue    Run a DLL as an App    Microsoft Corporation    c:/windows/system32/inf/svch0st.exe
+ zuoyue    Run a DLL as an App    Microsoft Corporation    c:/windows/system32/inf/svch0st.exe
HKCU/Software/Microsoft/Windows/CurrentVersion/Run           
+ ctfmon.exe    CTF Loader    Microsoft Corporation    c:/windows/system32/ctfmon.exe
+ dc            File not found: C:/WINDOWS/dc.exe
+ dc2k5            File not found: C:/WINDOWS/SVIQ.EXE
+ Fun            File not found: C:/WINDOWS/system/Fun.exe
+ imscmig            File not found: C:/WINDOWS/imscmig.exe