一位网友的电脑最近工作比较慢，让偶帮忙检修看看。
到 http://endurer.ys168.com 下载 HijackThis 和 ProcView。
先用 HijackThis 扫描 log，发现以下可疑项：
/------- Logfile of HijackThis v1.99.1 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:/WINDOWS/system32/MRTServ.exe F3 - REG:win.ini: load=C:/windows/system32/wincfgs.exe O4 - HKLM/../Run: [SOUNDM] win32smd.exe O20 - AppInit_DLLs: 919331M.BMP O21 - SSODL: IPicture - {D94D666A-0F7B-5892-A7E3-29340333F07E} - c:/program files/internet explorer/PLUGINS/IPictureEx.dll O21 - SSODL: QQMusic - {E16A6111-85DD-4877-8E67-017B0193D359} - C:/WINDOWS/QQMusic.dll O23 - Service: MRTServ - Unknown owner - C:/WINDOWS/system32/MRTServ.exe -------/
用 ProcView 导出系统进程列表，发现：
/------- Windows XP (5.1.2600 Service Pack 2) 2006-12-06 17:24:20进程列表 [System Process] C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/winlogon.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/services.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/lsass.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/svchost.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/svchost.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/System32/svchost.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/Explorer.EXE C:/WINDOWS/919331M.BMP c:/program files/internet explorer/PLUGINS/IPicture.dll C:/WINDOWS/msole.dll C:/WINDOWS/system32/KB9193316.LOG C:/WINDOWS/system32/spoolsv.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/MRTServ.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/svchost.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/System32/alg.exe C:/WINDOWS/919331M.BMP C:/Program Files/Common Files/Real/Update_OB/realsched.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/ctfmon.exe C:/WINDOWS/919331M.BMP C:/Program Files/Messenger/msmsgs.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/rundll32.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/conime.exe C:/WINDOWS/919331M.BMP C:/Program Files/Internet Explorer/iexplore.exe C:/WINDOWS/919331M.BMP C:/Downloads/HijackThis.exe C:/WINDOWS/919331M.BMP C:/WINDOWS/system32/NOTEPAD.EXE C:/WINDOWS/919331M.BMP -------/
重启电脑到安全模式下，
关闭系统还原功能
停止并禁用服务：MRTServ
用WinRAR找到下列文件，打包备份后删除：
