删除启动项
<1k3m5o7q.exe><; C:\WINDOWS\system32\1k3m5o7q.exe C:\WINDOWS\system32\drivers\1k3m5o7q.sys Rundll32> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<load><> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<iesearch><iesearch.exe> [N/A]
删除服务项
[Remote Packet Capture Protocol v.0 (experimental) / rpcapd][Stopped/Manual Start]
<"C:\Program Files\WinPcap\rpcapd.exe" -d -f "C:\Program Files\WinPcap\rpcapd.ini"><N/A>
[System Recover Servic / SysreSrv][Stopped/Auto Start]
<sysresrv.exe><N/A>
删除驱动服务
<system32\STDSB.sys><>
删除文件
C:\WINDOWS\system32\1k3m5o7q.exe
C:\WINDOWS\system32\drivers\1k3m5o7q.sys
iesearch.exe
C:\Program Files\WinPcap\rpcapd.ini
c:\windows\sysresrv.exe或是c:\windows\system32\sysresrv.exe
搜索注册表rpcapd找到删除整个项
