1.这里官网下载费尔木马强力清除助手,勾选“清除,并抑制文件再次生成”后删除以下文件:http://dl.filseclab.com/down/powerrmv.zipc:\windows\system32\mghefy.dll
c:\windows\system32\fsrgeb.dll
c:\windows\system32\sgdewg.dll
c:\windows\system32\mnmhgsrv.dll
c:\windows\system32\mpwdeapi.dll
c:\windows\system32\yzztimsn.dll
c:\windows\system32\mndhddwd.dll
c:\windows\system32\apsgdjba.dll
c:\windows\system32\mndsfsrv.dll
c:\windows\system32\zycbdime.dll
c:\windows\system32\zyzxiime.dll
c:\windows\system32\lofsdjbo.dll
c:\windows\system32\apfocdet.dll
c:\windows\system32\ietzapaq.dll
c:\windows\system32\zywmfime.dll
c:\windows\system32\skqncbib.dll
c:\windows\system32\oswxcttb.dll
c:\windows\system32\wyrsdj.dll
c:\windows\system32\tisqatyu.dll
c:\windows\system32\zyzxjime.dll
c:\windows\system32\ozfyebyt.dll
c:\windows\system32\nhmxcjkl.dll
c:\windows\system32\ietzbpaq.dll
c:\windows\system32\cdwsbkop.dll
c:\windows\system32\apsgejba.dll
c:\windows\system32\mndsgsrv.dll
c:\windows\system32\midimapgj.dll
c:\windows\system32\svchost.xy3
c:\windows\system32\wklsdd.dll
c:\windows\system32\tdffdl.dll
c:\windows\system32\zefdst.dll
c:\windows\system32\ddserh.dll
c:\windows\system32\rfdswc.dll
c:\windows\system32\wrqszl.dll
c:\windows\system32\tdfhex.dll
c:\windows\system32\jfrwdh.dll
c:\windows\system32\cedafb.dll
c:\windows\system32\jhfrxz.dll
c:\windows\system32\dndsaf.dll
c:\windows\system32\pedadt.dll
c:\windows\system32\ydggsx.dll
c:\windows\system32\jdsaex.dll
c:\windows\system32\tdggrz.dll
c:\windows\system32\fmcvxy.dll
c:\windows\system32\dpvvoxmh.dll
c:\documents and settings\all users\「开始」菜单\程序\启动\self.bat
c:\windows\system32\1b7f9e0e.exe
c:\docume~1\admini~1\locals~1\temp\_tmp.bat
c:\windows\system32\drivers\hbkernel.sys
2.删除重启后使用SREng修复下面各项: 启动项目 -- 注册表之如下项删除:
[{45AADFAA-DD36-42AB-83AD-0521BBF58C24}]
[{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}]
[{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}]
[{8C41B7F7-3168-400D-A702-0E7EFE0BA304}]
[{000030AE-0380-4351-8244-EE98A3240370}]
[{EB71E0B3-E97D-4D30-8733-E28266467617}]
[{4A069845-2036-6084-9054-6087502480A4}]
[{14698742-2059-3025-9058-954023874141}]
[{70AF1289-F140-A140-D012-C1458759FC07}]
[{91698482-6555-3666-1222-954784129019}]
[{35671234-7890-ABCD-CDEF-567801237653}]
[{83BA45AF-FAAA-CDDD-BEEE-BCDE1234AB38}]
[{50940F85-F015-14F1-A05F-F69858AC6D05}]
[{2D698451-2015-6358-9871-2015987452D2}]
[{22596546-2036-9451-6058-658402589722}]
[{528DF602-9541-A985-210A-984A698C6F25}]
[{81954FAC-1023-154F-895A-1458258AD818}]
[{6A041F13-A111-12A3-B0CF-F99818AA68A6}]
[{4629FF4F-ACDB-5C90-A098-FACB3456A264}]
[{5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5}]
[{7C8D1401-A58D-A81C-CD24-A5915C4517C7}]
[{55694105-5108-9405-3695-954187462155}]
[{9490415F-65F8-B5C5-D8BA-9405FB120549}]
[{4C648541-1025-9650-9057-6541258720C4}]
[{4FD45A54-9875-698F-E56E-65102358FDF4}]
[{67FD640A-158F-48AC-FD14-1597F14A9776}]
[{4A698102-5904-AFD0-20DF-CD1A65829CA4}]
[{9A59145F-315D-BC23-AC1F-145DF81A34A9}]
[{470165F1-9F65-569F-F895-F14F58F41074}]
[{3E035987-F585-68D1-AC28-98FA58E459E3}]
[{19109876-7619-9101-7012-901938475191}]
[{6319A1F1-9410-9654-3201-345FFA349136}]
[{32023698-6984-8541-9654-698745012523}]
[{33512378-9874-5641-1025-985420368733}]
[{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}]
[{18093456-9012-4568-9076-908765467181}]
[{AA59145F-315D-BC23-AC1F-145DF81A34AA}]
[{5A069845-2036-6084-9054-6087502480A5}]
[{37AC9076-C898-B098-D098-A18319080973}]
[{29109876-7619-9101-7012-901938475192}]
[{2A095412-A568-B258-C587-D148E148F0A2}]
[{5FD45A54-9875-698F-E56E-65102358FDF5}]
[{77FD640A-158F-48AC-FD14-1597F14A9777}]
[{4F4F0064-71E0-4f0d-0003-708476C7815F}]
注意该项[Userinit]修改:把<C:\WINDOWS\system32\userinit.exe,svchost.xy3>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略
[{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}]
[{C0595A7E-2E2F-4B34-A83A-019270A0A464}]
[{28EB3777-3E23-4E72-8449-A992D09D24C3}]
[{A9895933-6636-4281-BC58-EE6DE2AF96E3}]
[{461D2AB4-29A5-45C2-9134-D52272D3DE38}]
[{F99DEFDD-200B-4410-B572-E90883D527D2}]
[{0B846B26-BFE6-4E8E-A948-1DB17B77B483}]
[{841529CB-7F77-4B99-A895-B5441E0D302F}]
[{84143967-B645-4BFF-B873-DA1DC886E9A7}]
[{7914E0AA-ECCB-4311-B584-C49538227824}]
[{259BF3CF-194D-4FE6-9ADB-DE6544B098B6}]
[{5E907A48-400E-4EA8-9792-FFAE052D59E9}]
[{0086DD39-EB8E-4504-A085-AC8A433E34D0}]
[{B29583D8-033A-4B9F-8553-7C5458F3FB8E}]
[{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}]
[{73AE86E6-7F03-4C3B-8980-FB1DA157D3C7}]
[{00070007-0007-0007-0007-00070007BB15}]
[midimapgj]
[dpvvoxmh.dll]
启动项目 -- 启动文件夹之如下项删除:
[self]
启动项目 -- 服务 -- Win32服务应用程序之如下项删除:
[5ED83089 / 5ED83089]
启动项目 -- 服务-- 驱动程序之如下项删除:
[spnnk / spnnk]
[HBKernel Driver / HBKernel]
做完下载以下工具清理一次并更新杀毒软件至最新进行全盘杀毒
清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe 用金山清理专家清理恶意软件
http://www.duba.net/zt/ksc/down.shtml 下载 windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.zip