启动项
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]下
<fmsiocps><C:\WINDOWS\fmsiocps.exe> [File is missing]
<HBmhly><"C:\WINDOWS\system32\HBmhly.exe" -r> []
<SoundMan><SoundMan.exe> [1]
文件不正常,建议到
http://www.virscan.org/测试
改注册表
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><yzztnmsn.dll,arjrkler.dll,tisqdtyu.dll,nhmxejkl.dll> [N/A]
为 <AppInit_DLLs><>
删除启动项[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]下注册表项目及<>内文件
<{8C8D1401-A58D-A81C-CD24-A5915C4517C8}><C:\WINDOWS\system32\mnmhhsrv.dll> [File is missing]
<{00270027-0027-0027-0027-00270027BB15}><C:\WINDOWS\system32\wmpuiqhx.dll> [File is missing]
<{55694105-5108-9405-3695-954187462155}><C:\WINDOWS\system32\mpwdeapi.dll> [File is missing]
<{E490415F-65F8-B5C5-D8BA-9405FB12054E}><C:\WINDOWS\system32\yzztnmsn.dll> [File is missing]
<{6C648541-1025-9650-9057-6541258720C6}><C:\WINDOWS\system32\mndhfdwd.dll> [File is missing]
<{B629FF4F-ACDB-5C90-A098-FACB3456A26B}><C:\WINDOWS\system32\hdf453d.dll> [File is missing]
<{8A041F13-A111-12A3-B0CF-F99818AA68A8}><C:\WINDOWS\system32\zxmsewin.dll> [File is missing]
<{7FD45A54-9875-698F-E56E-65102358FDF7}><C:\WINDOWS\system32\apsggjba.dll> [File is missing]
<{A1954FAC-1023-154F-895A-1458258AD81A}><C:\WINDOWS\system32\ypdjhbmp.dll> [File is missing]
<{87FD640A-158F-48AC-FD14-1597F14A9778}><C:\WINDOWS\system32\mndshsrv.dll> [File is missing]
<{30618412-C528-C784-C056-C164D1F7C503}><C:\WINDOWS\system32\detxciua.dll> [File is missing]
<{2A698452-C5D8-C584-C256-C264C987C5A2}><C:\WINDOWS\system32\ijdybpaw.dll> [File is missing]
<{4D698451-2015-6358-9871-2015987452D4}><C:\WINDOWS\system32\apzhdtde.dll> [File is missing]
<{4A698102-5904-AFD0-20DF-CD1A65829CA4}><C:\WINDOWS\system32\zycbdime.dll> [File is missing]
<{AA59145F-315D-BC23-AC1F-145DF81A34AA}><C:\WINDOWS\system32\zyzxjime.dll> [File is missing]
<{50940F85-F015-14F1-A05F-F69858AC6D05}><C:\WINDOWS\system32\zptlcsys.dll> [File is missing]
<{DC69134A-F15F-D14D-A31A-C31C4D124FCD}><C:\WINDOWS\system32\arjrkler.dll> [File is missing]
<{6A908760-8000-4000-A000-9000322145A6}><C:\WINDOWS\system32\akjsfkaq.dll> [File is missing]
<{5D098345-6785-1098-5413-678067AE03D5}><C:\WINDOWS\system32\tysqbkol.dll> [File is missing]
<{57AC9076-C898-B098-D098-A18319080975}><C:\WINDOWS\system32\nhmxejkl.dll> [File is missing]
<{45671234-7890-ABCD-CDEF-567801237654}><C:\WINDOWS\system32\yxcsdhlp.dll> [File is missing]
<{7319A1F1-9410-9654-3201-345FFA349137}><C:\WINDOWS\system32\zywmgime.dll> [File is missing]
<{91698482-6555-3666-1222-954784129019}><C:\WINDOWS\system32\zxptejpg.dll> [File is missing]
<{80AF1289-F140-A140-D012-C1458759FC08}><C:\WINDOWS\system32\ypcqghlp.dll> [File is missing]
<{37A924AF-1A5F-CF21-AB1D-1D5CF82A8A73}><C:\WINDOWS\system32\zywlcime.dll> [File is missing]
<{14698742-2059-3025-9058-954023874141}><C:\WINDOWS\system32\jkhxaklo.dll> [File is missing]
<{39109876-7619-9101-7012-901938475193}><C:\WINDOWS\system32\ietzcpaq.dll> [File is missing]
<{25FD6584-698F-BCD2-602C-698745210352}><C:\WINDOWS\system32\rijxbkin.dll> [File is missing]
<{528DF602-9541-A985-210A-984A698C6F25}><C:\WINDOWS\system32\ptjhehlp.dll> [File is missing]
<{38093456-9012-4568-9076-908765467183}><C:\WINDOWS\system32\tisqctyu.dll> [File is missing]
<{97FD640A-158F-48AC-FD14-1597F14A9779}><C:\WINDOWS\system32\mndsisrv.dll> [File is missing]
<{40618412-C528-C784-C056-C164D1F7C504}><C:\WINDOWS\system32\detxdiua.dll> [File is missing]
<{8319A1F1-9410-9654-3201-345FFA349138}><C:\WINDOWS\system32\zywmhime.dll> [File is missing]
<{49109876-7619-9101-7012-901938475194}><C:\WINDOWS\system32\ietzdpaq.dll> [File is missing]
<{9319A1F1-9410-9654-3201-345FFA349139}><C:\WINDOWS\system32\zywmiime.dll> [File is missing]
<{C629FF4F-ACDB-5C90-A098-FACB3456A26C}><C:\WINDOWS\system32\hdf453d1.dll> [File is missing]
<{8FD45A54-9875-698F-E56E-65102358FDF8}><C:\WINDOWS\system32\apsghjba.dll> [File is missing]
<{50618412-C528-C784-C056-C164D1F7C505}><C:\WINDOWS\system32\detxeiua.dll> [File is missing]
<{90AF1289-F140-A140-D012-C1458759FC09}><C:\WINDOWS\system32\ypcqhhlp.dll> [File is missing]
<{47A924AF-1A5F-CF21-AB1D-1D5CF82A8A74}><C:\WINDOWS\system32\zywldime.dll> [File is missing]
<{48093456-9012-4568-9076-908765467184}><C:\WINDOWS\system32\tisqdtyu.dll> [File is missing]
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> []
<{841529CB-7F77-4B99-A895-B5441E0D302F}><C:\WINDOWS\system32\jfrwdh.dll> []
<{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}><C:\WINDOWS\system32\dndsaf.dll> []
<{EB71E0B3-E97D-4D30-8733-E28266467617}><C:\WINDOWS\system32\wyhesm.dll> []
<{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zycdex.dll> []
<{D47A61B8-0EAB-417F-8DF4-5C949982A2AF}><C:\Program Files\Internet Explorer\PLUGINS\Windows64.Sys> []
<{168dbb0c-c4b7-4d7d-afc1-ab847a0b1a1c}><MMKAFNFW1111.dll> [N/A]
<{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}><C:\WINDOWS\system32\jggtsr.dll> []
<{0B846B26-BFE6-4E8E-A948-1DB17B77B483}><C:\WINDOWS\system32\tdfhex.dll> []
<{7914E0AA-ECCB-4311-B584-C49538227824}><C:\WINDOWS\system32\jhfrxz.dll> []
删除启动项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Loader.exe]
<IFEO[360Loader.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe]
<IFEO[360Safe.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe]
<IFEO[360tray.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><SoundMan.exe> [1]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword]
<IFEO[IceSword]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Iparmor.exe]
<IFEO[Iparmor.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kmailmon.exe]
<IFEO[kmailmon.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ras]
<IFEO[ras]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep]
<IFEO[runiep]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
<IFEO[taskmgr.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
删除IE浏览器加载项
[]
{14698742-2059-3025-9058-954023874141} <C:\WINDOWS\system32\jkhxaklo.dll, N/A>
[]
{38093456-9012-4568-9076-908765467183} <C:\WINDOWS\system32\tisqctyu.dll, N/A>
[]
{50940F85-F015-14F1-A05F-F69858AC6D05} <C:\WINDOWS\system32\zptlcsys.dll, N/A>
[]
{5D098345-6785-1098-5413-678067AE03D5} <C:\WINDOWS\system32\tysqbkol.dll, N/A>
[]
{7FD45A54-9875-698F-E56E-65102358FDF7} <C:\WINDOWS\system32\apsggjba.dll, N/A>
[]
{D47A61B8-0EAB-417F-8DF4-5C949982A2AF} <C:\Program Files\Internet Explorer\PLUGINS\Windows64.Sys, N/A>
[]
{14698742-2059-3025-9058-954023874141} <C:\WINDOWS\system32\jkhxaklo.dll, N/A>
[]
{38093456-9012-4568-9076-908765467183} <C:\WINDOWS\system32\tisqctyu.dll, N/A>
[]
{50940F85-F015-14F1-A05F-F69858AC6D05} <C:\WINDOWS\system32\zptlcsys.dll, N/A>
[]
{5D098345-6785-1098-5413-678067AE03D5} <C:\WINDOWS\system32\tysqbkol.dll, N/A>
[]
{7FD45A54-9875-698F-E56E-65102358FDF7} <C:\WINDOWS\system32\apsggjba.dll, N/A>
[]
{D47A61B8-0EAB-417F-8DF4-5C949982A2AF} <C:\Program Files\Internet Explorer\PLUGINS\Windows64.Sys, N/A>
Ps:1.楼主在局域网??
2.弄完后再上传次新的日志