有如下的病毒文件twain.dll、realsched.pat、soundmans.exe、1sasrv.dll、adsldps.dll、hkcmd.pat，删除文件：
c:\windows\system32\twain.dll(正常的twain.dll应该是在c:\windows\下)
c:\windows\system32\realsched.pat
c:\windows\system32\soundmans.exe
c:\windows\system32\1sasrv.dll
c:\windows\system32\adsldps.dll
c:\documents and settings\all users\「开始」菜单\程序\启动\hkcmd.pat
还有AUTO病毒(AUTORUN.INF)保护方式：
[autorun]
open=patty.exe
shell\open=打开(&O)
shell\open\Command=patty.exe
shell\open\Default=1
shell\explore=资源管理器(&X)
shell\explore\Command=patty.exe
shell\find=搜索(&E)
shell\find\Command=patty.exe
各盘下都有autorun.inf及patty.exe，必须删除。
注册表如下项删除：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<boot-hf><c:\windows\BOOT-hf.exe>(这个可能是修复boot.ini的程序，不过也可能是病毒木马，关键看有没用修复boot.ini的程序)
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<realsched><C:\WINDOWS\system32\realsched.pat>
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\BITS]
<WinlogonNotify: BITS><C:\WINDOWS\System32\twain.dll>
然后是注册表中的映像劫持(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\)，就这项导致杀毒软件不能使用，本例中被劫持禁用的程序不少，这些被劫持的程序统统指向C:\WINDOWS\system32\SOUNDMANS.EXE，明显这个比声卡驱动程序多一个“S”的SOUNDMANS.EXE也是病毒程序：
360rpt.exe
360Safe.exe
360tray.exe
adam.exe
AgentSvr.exe
AppSvc32.exe
ArSwp.exe
ashAvast.exe
ashDisp.exe
ashMaiSv.exe
ashServ.exe
ashWebSv.exe
aswUpdSv.exe
autoruns.exe
avcenter.exe
avgamsvr.exe
avgas.exe
avgcc.exe
avgemc.exe
avgnt.exe
avguard.exe
avgupsvc.exe
avgw.exe
AvMonitor.exe
bdmcon.exe
bdnagent.exe
bdoesrv.exe
bdss.exe
bdswitch.exe
ccApp.exe
ccEvtMgr.exe
ccSetMgr.exe
ccSvcHst.exe
cureit.exe
DefWatch.exe
ewido.exe
fch32.exe
FileDsty.exe
fsbwsys.exe
FSGK32.EXE
fsgk32st.exe
FSM32.EXE
FTCleanerShell.exe
guard.exe
HijackThis.exe
IceSword.exe
iparmo.exe
isPwdSvc.exe
KaScrScn.SCR
KASMain.exe
KASTask.exe
KAV32.exe
KAVDX.exe
KAVPFW.exe
KAVSetup.exe
KAVStart.exe
KAVsvc.exe
KAVsvcUI.exe
KISLnchr.exe
KMailMon.exe
KMFilter.exe
KPFW32.exe
KPFW32X.exe
KPFWSvc.exe
KRegEx.exe
KRepair.COM
KsLoader.exe
KVCenter.kxp
KvDetect.exe
KvfwMcl.exe
KVMonXP.kxp
KVMonXP_1.kxp
kvol.exe
kvolself.exe
KvReport.kxp
KVScan.kxp
KVSrvXP.exe
KVStub.kxp
kvupload.exe
kvwsc.exe
KvXP.kxp
KvXP_1.kxp
KWatch.exe
KWatch9x.exe
KWatchX.exe
loaddll.exe
mcconsol.exe
Mcshield.exe
mmqczj.exe
mmsk.exe
MPStart.exe
NAVSetup.exe
nod32.exe
nod32krn.exe
nod32kui.exe
PFW.exe
PFWLiveUpdate.exe
PowerRmv.exe
QHSET.exe
Rtvscan.exe
runiep.exe
safelive.exe
SavRoam.exe
sched.exe
shcfg32.exe
shstat.exe
SREng.exe
symlcsvc.exe
SysSafe.exe
TrojanDetector.exe
Trojanwall.exe
TrojDie.kxp
UmxAgent.exe
UmxAttachment.exe
UmxCfg.exe
UmxFwHlp.exe
UmxPol.exe
vgrssvc.exe
vsserv.exe
Vstskmgr.exe
Wsyscheck.exe
xcommsvr.exe
XDelBox1.3.exe
>> 除非说明均为原创，如转载请注明来源于http://www.stormcn.cn/post/44.html
