用SRENG删除启动项注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<twin><C:\WINDOWS\system32\twunk32.exe> [Microsoft Corporation]
删除文件C:\WINDOWS\system32\twunk32.exe
C:\WINDOWS\system32\P0630Sti.dll
搜索注册表P0630Sti.dll,把搜索到的删除
正在运行程序:
[PID: 352][C:\WINDOWS\system32\svchost.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\P0630Sti.dll] [Creative Technology Ltd., 1.00.01.00]
备份后删除[C:\WINDOWS\system32\hccutils.DLL] [Intel Corporation, 3.0.0.3882]
搜索注册表hccutils.DLL,把搜索到的备份删除
