【回复“￡影子虫あ”的帖子】
建议用IceSword杀毒。
操作流程：
1、禁止进程创建。
2、结束下列进程：
[PID: 1728][C:\WINDOWS\Explorer.EXE]
[PID: 572][C:\Program Files\Sandai Technologies Inc\Thunder\Thunder.exe]
[PID: 2992][D:\Program Files\Tencent\QQ\TIMPlatform.exe]
[PID: 3108][C:\Program Files\Internet Explorer\iexplore.exe]
[PID: 684][D:\Program Files\Tencent\QQ\QZone\QZone.exe]
[PID: 3384][C:\Documents and Settings\v\桌面\智能扫描sreng2\SREng.EXE]
3、删除下列注册表内容：
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<34s7xwhdzqu8xw><C:\DOCUME~1\v\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<5z6l74t03><C:\DOCUME~1\v\LOCALS~1\Temp\rundl132.exe> [N/A]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<333><C:\Syswm1j\svchost.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<kernel32><C:\WINDOWS\Kernel32.exe> [N/A]
<upxdnd><C:\DOCUME~1\v\LOCALS~1\Temp\upxdnd.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{B8A170A8-7AD3-4678-B2FE-F2D7381CC1B5}><C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys> [N/A]
<{D14FA1E2-123F-6358-1E32-D2455234FDE2}><C:\WINDOWS\system32\nospri.dll> [N/A]
<{13B4E327-2C14-F46E-89D0-AADD240C8575}><C:\WINDOWS\system32\wersdf8.dll> [N/A]
<{5EED7056-B89D-4DE8-A060-D285EA746799}><C:\WINDOWS\system32\rpcuce.dll> [N/A]
<{5D06580A-08EB-4DD0-8425-DDBB5198B30C}><C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys> [N/A]
驱动程序
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
<system32\DRIVERS\npf.sys><CACE Technologies>
[电影搜索]
{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} <C:\WINDOWS\system32\nethelp.dll, Microsoft Corporation>
[电影搜索]
{A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} <C:\WINDOWS\system32\SpOrder.Dll, Microsoft Corporation>
[QQ]
{c95fe080-8f5d-11d2-a20b-00aa003c157b} <D:\Program Files\Tencent\QQ\QQ.EXE, TENCENT>
[电影搜索]
{0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} <C:\WINDOWS\system32\nethelp.dll, Microsoft Corporation>
[电影搜索]
{A6790AA5-C6C7-4BCF-A46D-0FDAC4EA90EB} <C:\WINDOWS\system32\SpOrder.Dll, Microsoft Corporation>
[]
4、删除下列文件：
C:\WINDOWS\system32\wersdf8.dll
C:\WINDOWS\system32\rpchss.dll
C:\DOCUME~1\v\LOCALS~1\Temp\~TmA.tmp..rom
C:\DOCUME~1\v\LOCALS~1\Temp\LgSy0.dll
C:\DOCUME~1\v\LOCALS~1\Temp\Rav20.dll
C:\WINDOWS\system32\JPWB.IME
C:\DOCUME~1\v\LOCALS~1\Temp\iexpl0re.exe
C:\DOCUME~1\v\LOCALS~1\Temp\rundl132.exe
C:\Syswm1j\svchost.exe
C:\WINDOWS\Kernel32.exe
C:\DOCUME~1\v\LOCALS~1\Temp\upxdnd.exe
C:\Program Files\Internet Explorer\Connection Wizard\isignup.sys
C:\WINDOWS\system32\nospri.dll
C:\WINDOWS\system32\wersdf8.dll
C:\WINDOWS\system32\rpcuce.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\IEINFO5.sys
C:\WINDOWS\system32\DRIVERS\npf.sys
C:\Syswm1j\svchost.exe
C:\WINDOWS\Kernel32.exe
C:\WINDOWS\system32\SpOrder.Dll
C:\WINDOWS\system32\nethelp.dll
5、取消IceSword的“禁止进程创建”。
