用扫日志的SRENG工具删除下面注册表项。（切记所有操作都不能打开E盘）
启动项目
注册表
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<y6l4etjht><D:\DOCUME~1\yl\LOCALS~1\Temp\1explore.exe> [N/A]
<g7h8zrsw9><D:\DOCUME~1\yl\LOCALS~1\Temp\iexp1ore.exe> [N/A]
<qvu><D:\DOCUME~1\yl\LOCALS~1\Temp\iexpl0re.exe> [N/A]
<3id><D:\DOCUME~1\yl\LOCALS~1\Temp\crasos.exe> [N/A]
<cd5vgd><D:\DOCUME~1\yl\LOCALS~1\Temp\iexp10re.exe> [N/A]
<0hyt><D:\DOCUME~1\yl\LOCALS~1\Temp\explorei.exe> [N/A]
<9><D:\DOCUME~1\yl\LOCALS~1\Temp\exp10rer.exe> [N/A]
<hzl8hguyi9ts4u><D:\DOCUME~1\yl\LOCALS~1\Temp\winlog0n.exe> [N/A]
<rwv><D:\DOCUME~1\yl\LOCALS~1\Temp\c0nime.exe> [N/A]
<m><D:\DOCUME~1\yl\LOCALS~1\Temp\Rav.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{1496D5ED-7A09-46D0-8C92-B8E71A4304DF}><D:\WINNT\System32\scandisk.dll> []
————————————————————————————————————————
用扫日志的SRENG工具将下面的各项启动类型改为“Disabled”，或删除。
服务
[Telephonyl / Windowsupdate][Stopped/Auto Start]
<D:\WINNT\System32\servev.exe><N/A>
[局域网通讯协议 / Hello World][Stopped/Auto Start]
<D:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.EXE><N/A>
[WinXP DHCP Service / WinXPDHCPsvc][Stopped/Auto Start]
<D:\WINNT\System32\rundll32.exe xpdhcp.dll,input><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
<D:\WINNT\System32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>
[Wireless Service / WZCSRVC][Stopped/Auto Start]
<D:\WINNT\System32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>
————————————————————————————————————————————
用扫日志的SRENG工具删除下面
HOSTS 文件
0.0.0.0 www.51pywg.com
0.0.0.0 51pywg.com
——————————————————————————————————————————
重启电脑，用冰刃找下面文件删除。（切记所有操作都不能打开E盘）
D:\WINNT\System32\csv.dll
D:\WINNT\System32\weftl.dll
D:\WINNT\System32\wtfsm.dll
D:\WINNT\System32\htysx.dll
D:\WINNT\System32\wuhdd.dll
D:\WINNT\System32\zwgfx.dll
D:\WINNT\System32\scandisk.dll
D:\DOCUME~1\yl\LOCALS~1\Temp\1explore.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\iexp1ore.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\iexpl0re.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\crasos.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\iexp10re.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\explorei.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\exp10rer.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\winlog0n.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\c0nime.exe
D:\DOCUME~1\yl\LOCALS~1\Temp\Rav.exe
D:\WINNT\System32\servev.exe
D:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.EXE
D:\WINNT\System32\xpdhcp.dll
D:\WINNT\System32\WMIApiSrv.dll
D:\WINNT\System32\netsrvcs.dll
E:\Autorun.inf
E:\SysAuto.exe
——————————————————————————————————————————
重启电脑，不行，就再扫日志。
没异常，就安装并升级杀软至最新版本，全盘杀毒。
