这里官网下载费尔木马强力清除助手,勾选“抑制文件再生”删除。
http://dl.filseclab.com/down/powerrmv.zip删除：
C:\DOCUME~1\new\LOCALS~1\Temp\1.tmp
C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys
C:\WINDOWS\system32\apfobdet.dll
C:\WINDOWS\system32\apsgajba.dll
C:\WINDOWS\system32\apzhbtde.dll
C:\WINDOWS\system32\cdwsbkop.dll
C:\WINDOWS\system32\cedafb.dll
C:\WINDOWS\system32\hfrdzx.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\windows\system32\inf\svchostc.exe
C:\WINDOWS\system32\jdsaex.dll
C:\WINDOWS\system32\jfrwdh.dll
C:\WINDOWS\system32\jhrcar.dll
C:\WINDOWS\system32\jkhxaklo.dll
C:\WINDOWS\system32\lijzalit.dll
C:\WINDOWS\system32\mfdesy.dll
C:\WINDOWS\system32\midimaptl.dll
C:\WINDOWS\system32\midimapwl.dll
C:\WINDOWS\system32\midimapzx.dll
C:\WINDOWS\system32\mndhcdwd.dll
C:\WINDOWS\system32\mndscsrv.dll
C:\WINDOWS\system32\mndsesrv.dll
C:\WINDOWS\system32\mnmhcsrv.dll
C:\WINDOWS\system32\mpmydapi.dll
C:\WINDOWS\system32\mpwdcapi.dll
C:\WINDOWS\system32\mtewdh.dll
C:\WINDOWS\system32\nhmxajkl.dll
C:\WINDOWS\system32\oohxcbyt.dll
C:\WINDOWS\system32\oswxattb.dll
C:\WINDOWS\system32\oswxcttb.dll
C:\WINDOWS\system32\ozfydbyt.dll
C:\WINDOWS\system32\pjjxcdwd.dll
C:\WINDOWS\system32\ptjhchlp.dll
C:\WINDOWS\system32\rfdswc.dll
C:\WINDOWS\system32\sgrefg.dll
C:\WINDOWS\system32\skqnbbib.dll
C:\WINDOWS\system32\wyhesm.dll
C:\WINDOWS\system32\wyrsdj.dll
C:\WINDOWS\system32\ypcqdhlp.dll
C:\WINDOWS\system32\ypdjebmp.dll
C:\WINDOWS\system32\yxcschlp.dll
C:\WINDOWS\system32\yzztgmsn.dll
C:\WINDOWS\system32\zgfdet.dll
C:\WINDOWS\system32\zptlcsys.dll
C:\WINDOWS\system32\zxmscwin.dll
C:\WINDOWS\system32\zywmdime.dll
C:\WINDOWS\system32\zyzxhime.dll
C:\windows\twftadfia16_080526.dll
不论删除结果如何继续下面操作。
——————————————————————————————————————————————————
这贴里下载那个我在28楼提供的附件，解压后运行，删除检测到的所有映像劫持。
http://bbs.ikaka.com/showtopic-8442813.aspx————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将下面项目置空（就是选择“编辑”）这必须关闭杀毒软件的监控，否则改不了可能。
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><SysWlaD.dll SysWoWaVi.dll SysZxaC.dll,nhmxajkl.dll> [N/A]
就是将 <AppInit_DLLs><SysWlaD.dll SysWoWaVi.dll SysZxaC.dll,nhmxajkl.dll> [N/A] 的“值”项编辑置空为：
<AppInit_DLLs><> [N/A]
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除：
启动项目
注册表
<nyuserinit><C:\windows\system32\inf\svchostc.exe C:\windows\twftadfia16_080526.dll tanlt88> [N/A]
<{2E035987-F585-68D1-AC28-98FA58E459E2}><C:\WINDOWS\system32\apfobdet.dll> []
<{1FD45A54-9875-698F-E56E-65102358FDF1}><C:\WINDOWS\system32\apsgajba.dll> []
<{50940F85-F015-14F1-A05F-F69858AC6D05}><C:\WINDOWS\system32\zptlcsys.dll> []
<{4B1AEF69-DDAE-FDAD-DCAB-698F026ABDB4}><C:\WINDOWS\system32\oohxcbyt.dll> []
<{3C648541-1025-9650-9057-6541258720C3}><C:\WINDOWS\system32\mndhcdwd.dll> []
<{7490415F-65F8-B5C5-D8BA-9405FB120547}><C:\WINDOWS\system32\yzztgmsn.dll> []
<{2A095412-A568-B258-C587-D148E148F0A2}><C:\WINDOWS\system32\cdwsbkop.dll> []
<{4629FF4F-ACDB-5C90-A098-FACB3456A264}><C:\WINDOWS\system32\mpmydapi.dll> []
<{1C954872-1230-6541-9548-6541025884C1}><C:\WINDOWS\system32\lijzalit.dll> []
<{71954FAC-1023-154F-895A-1458258AD817}><C:\WINDOWS\system32\ypdjebmp.dll> []
<{4319A1F1-9410-9654-3201-345FFA349134}><C:\WINDOWS\system32\zywmdime.dll> []
<{3C8D1401-A58D-A81C-CD24-A5915C4517C3}><C:\WINDOWS\system32\mnmhcsrv.dll> []
<{34FAE856-AD58-20CB-A025-CD4895FA6E43}><C:\WINDOWS\system32\pjjxcdwd.dll> []
<{50AF1289-F140-A140-D012-C1458759FC05}><C:\WINDOWS\system32\ypcqdhlp.dll> []
<{328DF602-9541-A985-210A-984A698C6F23}><C:\WINDOWS\system32\ptjhchlp.dll> []
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}><C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys> []
<{35694105-5108-9405-3695-954187462153}><C:\WINDOWS\system32\mpwdcapi.dll> []
<{37FD640A-158F-48AC-FD14-1597F14A9773}><C:\WINDOWS\system32\mndscsrv.dll> []
<{35671234-7890-ABCD-CDEF-567801237653}><C:\WINDOWS\system32\yxcschlp.dll> []
<{13512378-9874-5641-1025-985420368731}><C:\WINDOWS\system32\oswxattb.dll> []
<{33512378-9874-5641-1025-985420368733}><C:\WINDOWS\system32\oswxcttb.dll> []
<{1DB3C525-5271-46F7-887A-D4E1ADAA7632}><C:\WINDOWS\system32\hfrdzx.dll> []
<{28EB3777-3E23-4E72-8449-A992D09D24C3}><C:\WINDOWS\system32\zgfdet.dll> []
<{189F087F-4378-405F-85FA-37D955AD7A8C}><C:\WINDOWS\system32\mtewdh.dll> []
<{DC3D30AE-0380-4151-8934-EE98A34B0370}><C:\WINDOWS\system32\mfdesy.dll> []
<{6A041F13-A111-12A3-B0CF-F99818AA68A6}><C:\WINDOWS\system32\zxmscwin.dll> []
<{4F4F0064-71E0-4f0d-0017-708476C7815F}><C:\WINDOWS\system32\midimaptl.dll> [N/A]
<{4F4F0064-71E0-4f0d-0005-708476C7815F}><C:\WINDOWS\system32\midimapzx.dll> [N/A]
<{22023698-6984-8541-9654-698745012522}><C:\WINDOWS\system32\skqnbbib.dll> []
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> []
<{2D698451-2015-6358-9871-2015987452D2}><C:\WINDOWS\system32\apzhbtde.dll> []
<{EB71E0B3-E97D-4D30-8733-E28266467617}><C:\WINDOWS\system32\wyhesm.dll> []
<{841529CB-7F77-4B99-A895-B5441E0D302F}><C:\WINDOWS\system32\jfrwdh.dll> []
<{4F4F0064-71E0-4f0d-0004-708476C7815F}><C:\WINDOWS\system32\midimapwl.dll> [N/A]
<{84143967-B645-4BFF-B873-DA1DC886E9A7}><C:\WINDOWS\system32\cedafb.dll> []
<{461D2AB4-29A5-45C2-9134-D52272D3DE38}><C:\WINDOWS\system32\rfdswc.dll> []
<{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}><C:\WINDOWS\system32\jhrcar.dll> []
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgrefg.dll> []
<{57FD640A-158F-48AC-FD14-1597F14A9775}><C:\WINDOWS\system32\mndsesrv.dll> []
<{4A069845-2036-6084-9054-6087502480A4}><C:\WINDOWS\system32\ozfydbyt.dll> []
<{14698742-2059-3025-9058-954023874141}><C:\WINDOWS\system32\jkhxaklo.dll> []
<{17AC9076-C898-B098-D098-A18319080971}><C:\WINDOWS\system32\nhmxajkl.dll> []
<{B29583D8-033A-4B9F-8553-7C5458F3FB8E}><C:\WINDOWS\system32\jdsaex.dll> []
<{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll> []
<midimaptl><C:\WINDOWS\system32\midimaptl.dll> [N/A]
<midimapzx><C:\WINDOWS\system32\midimapzx.dll> [N/A]
<midimapwl><C:\WINDOWS\system32\midimapwl.dll> [N/A]
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除，
==================================
驱动程序
[IIS Manager / IIS Manager ][Stopped/Manual Start]
<\??\C:\DOCUME~1\new\LOCALS~1\Temp\1.tmp><N/A>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
浏览器加载项
[]
{13512378-9874-5641-1025-985420368731} <C:\WINDOWS\system32\oswxattb.dll, N/A>
[]
{14698742-2059-3025-9058-954023874141} <C:\WINDOWS\system32\jkhxaklo.dll, N/A>
[]
{17AC9076-C898-B098-D098-A18319080971} <C:\WINDOWS\system32\nhmxajkl.dll, N/A>
[]
{1C954872-1230-6541-9548-6541025884C1} <C:\WINDOWS\system32\lijzalit.dll, N/A>
[]
{1FD45A54-9875-698F-E56E-65102358FDF1} <C:\WINDOWS\system32\apsgajba.dll, N/A>
[]
{22023698-6984-8541-9654-698745012522} <C:\WINDOWS\system32\skqnbbib.dll, N/A>
[]
{2A095412-A568-B258-C587-D148E148F0A2} <C:\WINDOWS\system32\cdwsbkop.dll, N/A>
[]
{2D698451-2015-6358-9871-2015987452D2} <C:\WINDOWS\system32\apzhbtde.dll, N/A>
[]
{2E035987-F585-68D1-AC28-98FA58E459E2} <C:\WINDOWS\system32\apfobdet.dll, N/A>
[]
{328DF602-9541-A985-210A-984A698C6F23} <C:\WINDOWS\system32\ptjhchlp.dll, N/A>
[]
{33512378-9874-5641-1025-985420368733} <C:\WINDOWS\system32\oswxcttb.dll, N/A>
[]
{34FAE856-AD58-20CB-A025-CD4895FA6E43} <C:\WINDOWS\system32\pjjxcdwd.dll, N/A>
[]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
{35694105-5108-9405-3695-954187462153} <C:\WINDOWS\system32\mpwdcapi.dll, N/A>
[]
{37FD640A-158F-48AC-FD14-1597F14A9773} <C:\WINDOWS\system32\mndscsrv.dll, N/A>
[]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys, N/A>
[]
{3C648541-1025-9650-9057-6541258720C3} <C:\WINDOWS\system32\mndhcdwd.dll, N/A>
[]
{3C8D1401-A58D-A81C-CD24-A5915C4517C3} <C:\WINDOWS\system32\mnmhcsrv.dll, N/A>
[]
{4319A1F1-9410-9654-3201-345FFA349134} <C:\WINDOWS\system32\zywmdime.dll, N/A>
[]
{4629FF4F-ACDB-5C90-A098-FACB3456A264} <C:\WINDOWS\system32\mpmydapi.dll, N/A>
[]
{4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
{4B1AEF69-DDAE-FDAD-DCAB-698F026ABDB4} <C:\WINDOWS\system32\oohxcbyt.dll, N/A>
[]
{50940F85-F015-14F1-A05F-F69858AC6D05} <C:\WINDOWS\system32\zptlcsys.dll, N/A>
[]
{50AF1289-F140-A140-D012-C1458759FC05} <C:\WINDOWS\system32\ypcqdhlp.dll, N/A>
[]
{57FD640A-158F-48AC-FD14-1597F14A9775} <C:\WINDOWS\system32\mndsesrv.dll, N/A>
[]
{6A041F13-A111-12A3-B0CF-F99818AA68A6} <C:\WINDOWS\system32\zxmscwin.dll, N/A>
[]
{71954FAC-1023-154F-895A-1458258AD817} <C:\WINDOWS\system32\ypdjebmp.dll, N/A>
[]
{7490415F-65F8-B5C5-D8BA-9405FB120547} <C:\WINDOWS\system32\yzztgmsn.dll, N/A>
[]
{8A59145F-315D-BC23-AC1F-145DF81A34A8} <C:\WINDOWS\system32\zyzxhime.dll, N/A>
[]
{13512378-9874-5641-1025-985420368731} <C:\WINDOWS\system32\oswxattb.dll, N/A>
[]
{14698742-2059-3025-9058-954023874141} <C:\WINDOWS\system32\jkhxaklo.dll, N/A>
[]
{17AC9076-C898-B098-D098-A18319080971} <C:\WINDOWS\system32\nhmxajkl.dll, N/A>
[]
{1C954872-1230-6541-9548-6541025884C1} <C:\WINDOWS\system32\lijzalit.dll, N/A>
[]
{1FD45A54-9875-698F-E56E-65102358FDF1} <C:\WINDOWS\system32\apsgajba.dll, N/A>
[]
{22023698-6984-8541-9654-698745012522} <C:\WINDOWS\system32\skqnbbib.dll, N/A>
[]
{2A095412-A568-B258-C587-D148E148F0A2} <C:\WINDOWS\system32\cdwsbkop.dll, N/A>
[]
{2D698451-2015-6358-9871-2015987452D2} <C:\WINDOWS\system32\apzhbtde.dll, N/A>
[]
{2E035987-F585-68D1-AC28-98FA58E459E2} <C:\WINDOWS\system32\apfobdet.dll, N/A>
[]
{328DF602-9541-A985-210A-984A698C6F23} <C:\WINDOWS\system32\ptjhchlp.dll, N/A>
[]
{33512378-9874-5641-1025-985420368733} <C:\WINDOWS\system32\oswxcttb.dll, N/A>
[]
{34FAE856-AD58-20CB-A025-CD4895FA6E43} <C:\WINDOWS\system32\pjjxcdwd.dll, N/A>
[]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINDOWS\system32\yxcschlp.dll, N/A>
[]
{35694105-5108-9405-3695-954187462153} <C:\WINDOWS\system32\mpwdcapi.dll, N/A>
[]
{37FD640A-158F-48AC-FD14-1597F14A9773} <C:\WINDOWS\system32\mndscsrv.dll, N/A>
[]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys, N/A>
[]
{3C648541-1025-9650-9057-6541258720C3} <C:\WINDOWS\system32\mndhcdwd.dll, N/A>
[]
{3C8D1401-A58D-A81C-CD24-A5915C4517C3} <C:\WINDOWS\system32\mnmhcsrv.dll, N/A>
[]
{4319A1F1-9410-9654-3201-345FFA349134} <C:\WINDOWS\system32\zywmdime.dll, N/A>
[]
{4629FF4F-ACDB-5C90-A098-FACB3456A264} <C:\WINDOWS\system32\mpmydapi.dll, N/A>
[]
{4A069845-2036-6084-9054-6087502480A4} <C:\WINDOWS\system32\ozfydbyt.dll, N/A>
[]
{4B1AEF69-DDAE-FDAD-DCAB-698F026ABDB4} <C:\WINDOWS\system32\oohxcbyt.dll, N/A>
[]
{50940F85-F015-14F1-A05F-F69858AC6D05} <C:\WINDOWS\system32\zptlcsys.dll, N/A>
[]
{50AF1289-F140-A140-D012-C1458759FC05} <C:\WINDOWS\system32\ypcqdhlp.dll, N/A>
[]
{57FD640A-158F-48AC-FD14-1597F14A9775} <C:\WINDOWS\system32\mndsesrv.dll, N/A>
[]
{6A041F13-A111-12A3-B0CF-F99818AA68A6} <C:\WINDOWS\system32\zxmscwin.dll, N/A>
[]
{71954FAC-1023-154F-895A-1458258AD817} <C:\WINDOWS\system32\ypdjebmp.dll, N/A>
[]
{7490415F-65F8-B5C5-D8BA-9405FB120547} <C:\WINDOWS\system32\yzztgmsn.dll, N/A>
[]
{8A59145F-315D-BC23-AC1F-145DF81A34A8} <C:\WINDOWS\system32\zyzxhime.dll, N/A>
—————————————————————————————————————
用下载的“清理临时文件工具ATF-Cleaner-cn”，全选所有项目，点击“立即清理”
下载：
http://www.atribune.org/public-beta/ATF-Cleaner.exe用W i n d o w s 清理助手 ，清理你那系统。
W i n d o w s 清理助手 下载:
http://www.arswp.com/————————————————————————————————————
再重启电脑，反复检查，操作的结果，
————————————————————————————————————
再重启电脑，
升级杀毒软件至最新版本全盘杀毒。
下载卡卡助手，清理你那系统。
记得打打系统漏洞补丁
