这里官网下载费尔木马强力清除助手,勾选“抑制文件再生”删除。
http://dl.filseclab.com/down/powerrmv.zip删除：
c:\program files\internet explorer\plugins\dossys16.sys
c:\winnt\system32\ghjkdr.dll
c:\winnt\system32\hjmh.dll
c:\winnt\system32\skqncbib.dll
c:\winnt\system32\tisqatyu.dll
c:\winnt\system32\ukrth.dll
c:\program files\internet explorer\iexplore32.dat
c:\program files\internet explorer\iexplore32.sys
c:\program files\internet explorer\iexplore32.win
c:\winnt\system32\apfocdet.dll
c:\winnt\system32\apsgdjba.dll
c:\winnt\system32\apzhbtde.dll
c:\winnt\system32\cdwsbkop.dll
c:\winnt\system32\jkhxaklo.dll
c:\winnt\system32\lofsdjbo.dll
c:\winnt\system32\mndhddwd.dll
c:\winnt\system32\mndsfsrv.dll
c:\winnt\system32\mnmhfsrv.dll
c:\winnt\system32\mpmydapi.dll
c:\winnt\system32\mpwddapi.dll
c:\winnt\system32\oohxdbyt.dll
c:\winnt\system32\opshbbty.dll
c:\winnt\system32\oswxcttb.dll
c:\winnt\system32\ozfydbyt.dll
c:\winnt\system32\pjjxddwd.dll
c:\winnt\system32\ptjhehlp.dll
c:\winnt\system32\ypcqfhlp.dll
c:\winnt\system32\ypdjfbmp.dll
c:\winnt\system32\yxcschlp.dll
c:\winnt\system32\yxfhcjpg.dll
c:\winnt\system32\yzzthmsn.dll
c:\winnt\system32\zptlcsys.dll
c:\winnt\system32\zxmscwin.dll
c:\winnt\system32\zxptejpg.dll
c:\winnt\system32\zycbdime.dll
c:\winnt\system32\zywmfime.dll
c:\winnt\system32\zyzxiime.dll
c:\winnt\ticisms.exe
c:\winnt\fmsiocps.exe
c:\winnt\anistio.exe
c:\winnt\system32\mmkafnfw1095.dll
c:\winnt\system32\mmmhxggd1059.dll
c:\winnt\issms32.exe
c:\winnt\dionpis.exe
c:\winnt\fmbiost.exe
c:\winnt\fmsjhif.exe
c:\winnt\bincdwsa.exe
c:\winnt\dbhlp32.exe
c:\winnt\371662m.exe
c:\winnt\fmsbbqi.exe
c:\winnt\ptshell.exe
c:\winnt\ybsimtny.exe
c:\winnt\hefcndy.exe
c:\winnt\tciocp64.exe
c:\winnt\mfchlp64.exe
c:\winnt\huifitc.exe
c:\winnt\system32\drivers\0052008d.sys
c:\docume~1\admini~1\locals~1\temp\tmp4c5.tmp
c:\winnt\system32\drivers\hcv32_c.sys
c:\winnt\system32\drivers\hdv32_c.sys
c:\docume~1\admini~1\locals~1\temp\1.tmp
c:\docume~1\admini~1\locals~1\temp\tmp1.tmp
c:\docume~1\admini~1\locals~1\temp\tmp4ca.tmp
c:\winnt\system32\drivers\msosmsfpfis64.sys
c:\winnt\system32\drivers\msosmsp2p32.sys
c:\docume~1\admini~1\locals~1\temp\tmp4c1.tmp
C:\Documents and Settings\All Users\「开始」菜单\程序\启动\explorer.exe
不论删除结果如何继续下面操作。
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除：
启动项目
注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<fmsiocps><C:\WINNT\fmsiocps.exe> [File is missing]
<anistio><C:\WINNT\anistio.exE> [File is missing]
<issms32><C:\WINNT\issms32.exe> [File is missing]
<dionpis><C:\WINNT\dionpis.exe> [File is missing]
<fmbiost><C:\WINNT\fmbiost.exe> [File is missing]
<fmsjhif><C:\WINNT\fmsjhif.exe> [File is missing]
<bincdwsa><C:\WINNT\bincdwsa.exe> [File is missing]
<dbhlp32><C:\WINNT\dbhlp32.exe> [File is missing]
<WinSysM><C:\WINNT\371662M.exe> [File is missing]
<fmsbbqi><C:\WINNT\fmsbbqi.exe> [File is missing]
<ptshell><C:\WINNT\ptshell.exe> [File is missing]
<xytbzsli><C:\WINNT\ybsimtny.exe> [File is missing]
<hefcndy><C:\WINNT\hefcndy.exe> [File is missing]
<tciocp64><C:\WINNT\tciocp64.exe> [File is missing]
<mfchlp64><C:\WINNT\mfchlp64.exe> [File is missing]
<huifitc><C:\WINNT\huifitc.exe> [File is missing]
<ticisms><C:\WINNT\ticisms.exe> [File is missing]
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}><C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys> []
<{33496778-0658-40bc-8352-a8f884ca282b}><C:\WINNT\system32\MMKAFNFW1095.dll> [File is missing]
<{70941867-472d-4469-9665-3c6bb7d2f0df}><C:\WINNT\system32\MMMHXGGD1059.dll> [File is missing]
<{C5E87A05-F463-4841-B19E-DD3EC3862368}><C:\Program Files\Internet Explorer\IEXPLORE32.Sys> []
<{EE12D60D-AD9A-4095-B839-3BE6862679FD}><C:\Program Files\Internet Explorer\IEXPLORE32.Dat> []
<{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E}><C:\Program Files\Internet Explorer\IEXPLORE32.win> []
<{6C8D1401-A58D-A81C-CD24-A5915C4517C6}><C:\WINNT\system32\mnmhfsrv.dll> []
<{5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5}><C:\WINNT\system32\oohxdbyt.dll> []
<{45694105-5108-9405-3695-954187462154}><C:\WINNT\system32\mpwddapi.dll> []
<{8490415F-65F8-B5C5-D8BA-9405FB120548}><C:\WINNT\system32\yzzthmsn.dll> []
<{4C648541-1025-9650-9057-6541258720C4}><C:\WINNT\system32\mndhddwd.dll> []
<{4629FF4F-ACDB-5C90-A098-FACB3456A264}><C:\WINNT\system32\mpmydapi.dll> []
<{6A041F13-A111-12A3-B0CF-F99818AA68A6}><C:\WINNT\system32\zxmscwin.dll> []
<{4FD45A54-9875-698F-E56E-65102358FDF4}><C:\WINNT\system32\apsgdjba.dll> []
<{81954FAC-1023-154F-895A-1458258AD818}><C:\WINNT\system32\ypdjfbmp.dll> []
<{67FD640A-158F-48AC-FD14-1597F14A9776}><C:\WINNT\system32\mndsfsrv.dll> []
<{528DF602-9541-A985-210A-984A698C6F25}><C:\WINNT\system32\ptjhehlp.dll> []
<{22596546-2036-9451-6058-658402589722}><C:\WINNT\system32\opshbbty.dll> []
<{2D698451-2015-6358-9871-2015987452D2}><C:\WINNT\system32\apzhbtde.dll> []
<{4A698102-5904-AFD0-20DF-CD1A65829CA4}><C:\WINNT\system32\zycbdime.dll> []
<{9A59145F-315D-BC23-AC1F-145DF81A34A9}><C:\WINNT\system32\zyzxiime.dll> []
<{50940F85-F015-14F1-A05F-F69858AC6D05}><C:\WINNT\system32\zptlcsys.dll> []
<{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}><C:\WINNT\system32\yxfhcjpg.dll> []
<{470165F1-9F65-569F-F895-F14F58F41074}><C:\WINNT\system32\lofsdjbo.dll> []
<{3E035987-F585-68D1-AC28-98FA58E459E3}><C:\WINNT\system32\apfocdet.dll> []
<{44FAE856-AD58-20CB-A025-CD4895FA6E44}><C:\WINNT\system32\pjjxddwd.dll> []
<{35671234-7890-ABCD-CDEF-567801237653}><C:\WINNT\system32\yxcschlp.dll> []
<{6319A1F1-9410-9654-3201-345FFA349136}><C:\WINNT\system32\zywmfime.dll> []
<{91698482-6555-3666-1222-954784129019}><C:\WINNT\system32\zxptejpg.dll> []
<{70AF1289-F140-A140-D012-C1458759FC07}><C:\WINNT\system32\ypcqfhlp.dll> []
<{32023698-6984-8541-9654-698745012523}><C:\WINNT\system32\skqncbib.dll> []
<{14698742-2059-3025-9058-954023874141}><C:\WINNT\system32\jkhxaklo.dll> []
<{33512378-9874-5641-1025-985420368733}><C:\WINNT\system32\oswxcttb.dll> []
<{2A095412-A568-B258-C587-D148E148F0A2}><C:\WINNT\system32\cdwsbkop.dll> []
<{4A069845-2036-6084-9054-6087502480A4}><C:\WINNT\system32\ozfydbyt.dll> []
<{18093456-9012-4568-9076-908765467181}><C:\WINNT\system32\tisqatyu.dll> []
<IFEO[CCenter.exe]><ntsd -d> [N/A]
<IFEO[KPPMain.exe]><ntsd -d> [N/A]
<IFEO[KWatch.exe]><ntsd -d> [N/A]
<IFEO[QQDoctor.exe]><ntsd -d> [N/A]
<IFEO[QQKav.exe]><ntsd -d> [N/A]
<IFEO[RavMon.exe]><ntsd -d> [N/A]
<IFEO[RavMonD.exe]><ntsd -d> [N/A]
<IFEO[tqat.exe]><ntsd -d> [N/A]
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将<AppInit_DLLs>项目置空（就是选择“编辑”）这必须关闭杀毒软件的监控，否则改不了可能。
就是将 <AppInit_DLLs> 的“值”项编辑置空，所有涉及的都清除掉。
你可以选择其中一个红色项，然后编辑时你可能看不到什么，只需要在值项里输入任意一个字母或数字即可。
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除，
==================================
驱动程序
[0052008d / 0052008d][Stopped/Manual Start]
<\??\C:\WINNT\system32\Drivers\0052008d.sys><N/A>
[fmsq / fmsq][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp4C5.tmp><N/A>
[Hcv32 / Hcv32][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\Hcv32_c.sys><N/A>
[Hdv32 / Hdv32][Stopped/Manual Start]
<\??\C:\WINNT\system32\drivers\Hdv32_c.sys><N/A>
[IIS Manager / IIS Manager ][Stopped/Manual Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\1.tmp><N/A>
[mhfp / mhfp][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp1.tmp><N/A>
[mnsf / mnsf][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp4CA.tmp><N/A>
[msfpfis64 / msfpfis64][Stopped/Auto Start]
<\??\C:\WINNT\system32\drivers\msosmsfpfis64.sys><N/A>
[msp2p32 / msp2p32][Stopped/Auto Start]
<\??\C:\WINNT\system32\drivers\msosmsp2p32.sys><N/A>
[zftp / zftp][Stopped/Auto Start]
<\??\C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmp4C1.tmp><N/A>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
==================================
浏览器加载项
[]
{14698742-2059-3025-9058-954023874141} <C:\WINNT\system32\jkhxaklo.dll, N/A>
[]
{18093456-9012-4568-9076-908765467181} <C:\WINNT\system32\tisqatyu.dll, N/A>
[]
{22596546-2036-9451-6058-658402589722} <C:\WINNT\system32\opshbbty.dll, N/A>
[]
{2A095412-A568-B258-C587-D148E148F0A2} <C:\WINNT\system32\cdwsbkop.dll, N/A>
[]
{2D698451-2015-6358-9871-2015987452D2} <C:\WINNT\system32\apzhbtde.dll, N/A>
[]
{32023698-6984-8541-9654-698745012523} <C:\WINNT\system32\skqncbib.dll, N/A>
[]
{33512378-9874-5641-1025-985420368733} <C:\WINNT\system32\oswxcttb.dll, N/A>
[]
{35671234-7890-ABCD-CDEF-567801237653} <C:\WINNT\system32\yxcschlp.dll, N/A>
[]
{398C9B84-4EF7-47B5-9862-DE29543B3C42} <C:\Program Files\Internet Explorer\PLUGINS\DosSys16.Sys, N/A>
[]
{3E035987-F585-68D1-AC28-98FA58E459E3} <C:\WINNT\system32\apfocdet.dll, N/A>
[]
{44FAE856-AD58-20CB-A025-CD4895FA6E44} <C:\WINNT\system32\pjjxddwd.dll, N/A>
[]
{45694105-5108-9405-3695-954187462154} <C:\WINNT\system32\mpwddapi.dll, N/A>
[]
{4629FF4F-ACDB-5C90-A098-FACB3456A264} <C:\WINNT\system32\mpmydapi.dll, N/A>
[]
{470165F1-9F65-569F-F895-F14F58F41074} <C:\WINNT\system32\lofsdjbo.dll, N/A>
[]
{4A069845-2036-6084-9054-6087502480A4} <C:\WINNT\system32\ozfydbyt.dll, N/A>
[]
{4A698102-5904-AFD0-20DF-CD1A65829CA4} <C:\WINNT\system32\zycbdime.dll, N/A>
[]
{4C648541-1025-9650-9057-6541258720C4} <C:\WINNT\system32\mndhddwd.dll, N/A>
[]
{4FD45A54-9875-698F-E56E-65102358FDF4} <C:\WINNT\system32\apsgdjba.dll, N/A>
[]
{50940F85-F015-14F1-A05F-F69858AC6D05} <C:\WINNT\system32\zptlcsys.dll, N/A>
[]
{528DF602-9541-A985-210A-984A698C6F25} <C:\WINNT\system32\ptjhehlp.dll, N/A>
[]
{5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5} <C:\WINNT\system32\oohxdbyt.dll, N/A>
[]
{6319A1F1-9410-9654-3201-345FFA349136} <C:\WINNT\system32\zywmfime.dll, N/A>
[]
{67FD640A-158F-48AC-FD14-1597F14A9776} <C:\WINNT\system32\mndsfsrv.dll, N/A>
[]
{6A041F13-A111-12A3-B0CF-F99818AA68A6} <C:\WINNT\system32\zxmscwin.dll, N/A>
[]
{6C8D1401-A58D-A81C-CD24-A5915C4517C6} <C:\WINNT\system32\mnmhfsrv.dll, N/A>
[]
{70AF1289-F140-A140-D012-C1458759FC07} <C:\WINNT\system32\ypcqfhlp.dll, N/A>
[]
{81954FAC-1023-154F-895A-1458258AD818} <C:\WINNT\system32\ypdjfbmp.dll, N/A>
[]
{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38} <C:\WINNT\system32\yxfhcjpg.dll, N/A>
[]
{8490415F-65F8-B5C5-D8BA-9405FB120548} <C:\WINNT\system32\yzzthmsn.dll, N/A>
[]
{91698482-6555-3666-1222-954784129019} <C:\WINNT\system32\zxptejpg.dll, N/A>
[]
{9A59145F-315D-BC23-AC1F-145DF81A34A9} <C:\WINNT\system32\zyzxiime.dll, N/A>
[]
{A45B2C37-01D0-4D3E-BE5E-CC119B17BE9E} <C:\Program Files\Internet Explorer\IEXPLORE32.win, N/A>
[]
{C5E87A05-F463-4841-B19E-DD3EC3862368} <C:\Program Files\Internet Explorer\IEXPLORE32.Sys, N/A>
[]
{EE12D60D-AD9A-4095-B839-3BE6862679FD} <C:\Program Files\Internet Explorer\IEXPLORE32.Dat, N/A>
—————————————————————————————————————
用下载的“清理临时文件工具ATF-Cleaner-cn”，全选所有项目，点击“立即清理”
下载：
http://www.atribune.org/public-beta/ATF-Cleaner.exe用W i n d o w s 清理助手 ，清理你那系统。
W i n d o w s 清理助手 下载:
http://www.arswp.com/————————————————————————————————————
再重启电脑，反复检查，操作的结果，
————————————————————————————————————
再重启电脑，
升级杀毒软件至最新版本全盘杀毒。
下载卡卡助手，清理你那系统。
记得打打系统漏洞补丁
