有一个病毒怎么也杀不掉
文件名：ztdpri.dll
文件路径：c:windows\system32
病毒名：Trojan.psw.win32.ZhengTu.jzp
这个文件找不到，所以也删不掉这个文件

看下反病毒区的置顶贴.

用winrar找到以下文件，将其重命名（如1.dll 2.dll 3.dll.......随便改名，但要记住）
C:\WINDOWS\system32\qhbpri.dll
C:\WINDOWS\system32\wdbpri.dll
C:\WINDOWS\system32\dhdpri.dll
C:\WINDOWS\system32\jzgpri.dll
C:\WINDOWS\system32\myepri.dll
C:\WINDOWS\system32\wlfpri.dll
C:\WINDOWS\system32\zxgpri.dll
C:\WINDOWS\system32\tlupri.dll
C:\WINDOWS\system32\ztdpri.dll

打开SREng->启动项目->注册表->删除以下启动项目
    <svc><C:\DOCUME~1\Owner\LOCALS~1\Temp\ravsons.exe>  [N/A]
    <{42A612A4-4334-4424-4234-42261A31A236}><C:\WINDOWS\system32\pdkpri.dll>  [N/A]
    <{DE35052A-9E37-4827-A1EC-79BF400D27A4}><C:\Program Files\Internet Explorer\PLUGINS\System64.aaa>  [N/A]
    <{3495D328-661A-4FB0-BA67-8ACDD1704D1E}><C:\WINDOWS\system32\jh.dll>  [N/A]
    <{13BA17C4-1BB2-1F70-235D-278A2B2D2F43}><C:\WINDOWS\system32\wmgj2qso.dll>  [N/A]
    <{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys>  [N/A]
    <{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\system32\qhbpri.dll>  [N/A]
    <{2F12545B-1212-1314-5679-4512ACEF8902}><C:\WINDOWS\system32\wdbpri.dll>  [N/A]
    <{90BC520C-9175-470E-94B8-10FD869D170B}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.yer>  [N/A]
    <{42311A42-AC1B-158F-FD32-5674345F23A4}><C:\WINDOWS\system32\dhdpri.dll>  [N/A]
    <{759AFD5B-159F-ACD8-954C-ACD545FA6587}><C:\WINDOWS\system32\jzgpri.dll>  [N/A]
    <{5562452F-FA36-BA4F-892A-FF5FBBAC5315}><C:\WINDOWS\system32\myepri.dll>  [N/A]
    <{3182C1EB-375C-573D-1F5E-234552345213}><C:\WINDOWS\system32\wlfpri.dll>  [N/A]
    <{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\system32\zxgpri.dll>  [N/A]
    <{A12BC423-3713-224D-3F55-32B35C62B11A}><C:\WINDOWS\system32\tlupri.dll>  [N/A]
    <{41351752-5628-1547-FFAB-BADC13512AF4}><C:\WINDOWS\system32\ztdpri.dll>  []
    <N/A><C:\WINDOWS\system32\mh100.exe>  [N/A]
    <N/A><C:\WINDOWS\system32\nwizwlwz.exe>  [N/A]
    <N/A><C:\WINDOWS\system32\mydata.exe>  [N/A]
    <N/A><C:\WINDOWS\system32\nwizhx2.exe>  [N/A]

打开SREng->启动项目->服务->"Win32服务应用程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>
[Wireless Service / WZCSRVC][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>

打开SREng->启动项目->服务->驱动程序"选中"隐藏已认证的微软服务" 然后将下面名称的服务删除（选中有问题的服务后，点“删除服务”，点“设置”按钮即可。  注意弹出的窗口中要点 “NO 否”才是确认删除服务）(不能删除的就禁用:启动类型改为disabled,点中修改启动类型，点设置):
[khrgpakf / khrgpakf][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\khrgpakf.sys><N/A>

SRE--》系统修复--》浏览器加载项--》删除以下项目
[]
  {F79B2338-A6E7-46D4-9202-422AA6E74F43} <C:\WINDOWS\EagleFlt.dll, N/A>
[]
  {F79B2338-A6E7-46D4-9202-422AA6E74F43} <C:\WINDOWS\EagleFlt.dll, N/A>

重启  用冰刃删除以下文件
C:\WINDOWS\system32\ztdpri.dll
C:\WINDOWS\system32\ztdpri.dll
C:\WINDOWS\HKNTDLL.dll
C:\WINDOWS\EagleFlt.dll
C:\WINDOWS\system32\WMIApiSrv.dll
C:\WINDOWS\system32\netsrvcs.dll
C:\WINDOWS\system32\RemoteDbg.dll
C:\DOCUME~1\Owner\LOCALS~1\Temp\ravsons.exe
C:\WINDOWS\system32\pdkpri.dll
C:\Program Files\Internet Explorer\PLUGINS\System64.aaa
C:\WINDOWS\system32\jh.dll
C:\WINDOWS\system32\wmgj2qso.dll
C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.yer
C:\WINDOWS\system32\qhbpri.dll
C:\WINDOWS\system32\wdbpri.dll
C:\WINDOWS\system32\dhdpri.dll
C:\WINDOWS\system32\jzgpri.dll
C:\WINDOWS\system32\myepri.dll
C:\WINDOWS\system32\wlfpri.dll
C:\WINDOWS\system32\zxgpri.dll
C:\WINDOWS\system32\tlupri.dll
C:\WINDOWS\system32\ztdpri.dll
C:\WINDOWS\system32\mh100.exe
C:\WINDOWS\system32\nwizwlwz.exe
C:\WINDOWS\system32\mydata.exe
C:\WINDOWS\system32\nwizhx2.exe
C:\WINDOWS\system32\drivers\khrgpakf.sys

有问题的注册表启动项目
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    <svc><C:\DOCUME~1\Owner\LOCALS~1\Temp\ravsons.exe>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    <{D157330A-9EF3-49F8-9A67-4141AC41ADD4}><>  [N/A]
    <{42A612A4-4334-4424-4234-42261A31A236}><C:\WINDOWS\system32\pdkpri.dll>  [N/A]
    <{DE35052A-9E37-4827-A1EC-79BF400D27A4}><C:\Program Files\Internet Explorer\PLUGINS\System64.aaa>  [N/A]
    <{3495D328-661A-4FB0-BA67-8ACDD1704D1E}><C:\WINDOWS\system32\jh.dll>  [N/A]
    <{13BA17C4-1BB2-1F70-235D-278A2B2D2F43}><C:\WINDOWS\system32\wmgj2qso.dll>  [N/A]
    <{40117B96-998D-4D80-8F89-5E9DBD9F3460}><C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys>  [N/A]
    <{26368135-64FA-BC34-DA32-DCF4FD431C92}><C:\WINDOWS\system32\qhbpri.dll>  [N/A]
    <{2F12545B-1212-1314-5679-4512ACEF8902}><C:\WINDOWS\system32\wdbpri.dll>  [N/A]
    <{90BC520C-9175-470E-94B8-10FD869D170B}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.yer>  [N/A]
    <{42311A42-AC1B-158F-FD32-5674345F23A4}><C:\WINDOWS\system32\dhdpri.dll>  [N/A]
    <{759AFD5B-159F-ACD8-954C-ACD545FA6587}><C:\WINDOWS\system32\jzgpri.dll>  [N/A]
    <{5562452F-FA36-BA4F-892A-FF5FBBAC5315}><C:\WINDOWS\system32\myepri.dll>  [N/A]
    <{3182C1EB-375C-573D-1F5E-234552345213}><C:\WINDOWS\system32\wlfpri.dll>  [N/A]
    <{7A65498A-7653-9801-1647-987114AB7F47}><C:\WINDOWS\system32\zxgpri.dll>  [N/A]
    <{A12BC423-3713-224D-3F55-32B35C62B11A}><C:\WINDOWS\system32\tlupri.dll>  [N/A]
    <{41351752-5628-1547-FFAB-BADC13512AF4}><C:\WINDOWS\system32\ztdpri.dll>  []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3A202177-913D-112B-54CD-72FF5FE1CF20}]
    <N/A><C:\WINDOWS\system32\mh100.exe>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44112103-934D-21CF-64CD-11EF5012AF20}]
    <N/A><C:\WINDOWS\system32\nwizwlwz.exe>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6A202101-A04D-21cf-65CD-31FF5FE1CF20}]
    <N/A><C:\WINDOWS\system32\mydata.exe>  [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{95192103-834D-71CF-64CD-51E15112AF20}]
    <N/A><C:\WINDOWS\system32\nwizhx2.exe>  [N/A]
==================================
有问题的服务
[Remote Debug Service / RemoteDbg][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe RemoteDbg.dll,input><Microsoft Corporation>
[WMI Performance API / WMIApiSrv][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe WMIApiSrv.dll,input><Microsoft Corporation>
[Wireless Service / WZCSRVC][Stopped/Auto Start]
  <C:\WINDOWS\system32\rundll32.exe netsrvcs.dll,input><Microsoft Corporation>

==================================
有问题的驱动程序
[khrgpakf / khrgpakf][Running/Boot Start]
  <\SystemRoot\\SystemRoot\System32\drivers\khrgpakf.sys><N/A>
[Netgroup Packet Filter / NPF][Stopped/Manual Start]
  <system32\drivers\npf.sys><CACE Technologies>
==================================
有问题的文件
C:\PROGRA~1\sanlink\INPUT_~1\contmenu.dll
C:\WINDOWS\HKNTDLL.dll
C:\WINDOWS\system32\ztdpri.dll
system32\drivers\npf.sys
\System32\drivers\khrgpakf.sys
C:\WINDOWS\system32\netsrvcs.dll
C:\WINDOWS\system32\WMIApiSrv.dll
C:\WINDOWS\system32\RemoteDbg.dll
C:\WINDOWS\system32\nwizhx2.exe
C:\WINDOWS\system32\mydata.exe
C:\WINDOWS\system32\nwizwlwz.exe
C:\WINDOWS\system32\mh100.exe
C:\WINDOWS\system32\ztdpri.dll
C:\WINDOWS\system32\tlupri.dll
C:\WINDOWS\system32\zxgpri.dll
C:\WINDOWS\system32\wlfpri.dll
C:\WINDOWS\system32\myepri.dll
C:\WINDOWS\system32\jzgpri.dll
C:\WINDOWS\system32\dhdpri.dll
C:\Program Files\Internet Explorer\PLUGINS\SysWin64.Sys
C:\WINDOWS\system32\wdbpri.dll
C:\WINDOWS\system32\qhbpri.dll
C:\Program Files\Common Files\Microsoft Shared\MSINFO\SysInfo.yer
C:\WINDOWS\system32\wmgj2qso.dll
C:\WINDOWS\system32\jh.dll
C:\Program Files\Internet Explorer\PLUGINS\System64.aaa
C:\WINDOWS\system32\pdkpri.dll
C:\DOCUME~1\Owner\LOCALS~1\Temp\ravsons.exe
==================================
上班了，晚上再讲怎么杀，88……
==================================

【回复“超级游戏迷”的帖子】
88