先下载工具：
XDelBox下载
http://www.dodudou.com/down打开后选择【原创软件】，下载XDelBox1.7支持奥运版
Windows清理助手
下载
http://www.arswp.com/download/arswp2/setup.exe———————————————————————————————————————
务必断开网络链接后再进行以下操作
———————————————————————————————————————
使用XDelBox删除以下文件：
使用时一定拔掉所有移动存储设备，
将下面分隔线中的的文件路径全部复制，
然后打开XDelBox直接使用右键菜单的“剪贴板导入不检查路径”导入，
勾选“抑制再生”、“驱动安全删除模式”、“备份文件”，
最后选择右键菜单的“立刻重启删除”
———————————————————————————————————————
c:\windows.0\system32\explore.exe
c:\windows.0\svchost.exe
c:\windows.0\spoolst.exe
c:\windows.0\csrss.exe
c:\windows.0\system32\twainyy.dll
c:\windows.0\system32\lweurqhx.dll
c:\windows.0\system32\dpvvoxmh.dll
c:\windows.0\system32\avicapwm.dll
c:\windows.0\system32\pgugrtqe.dll
c:\windows.0\system32\certmgrkd.dll
c:\windows.0\system32\imgutilhx2.dll
c:\windows.0\system32\xolehlpjh.dll
c:\windows.0\system32\slbiopfs2.dll
c:\windows.0\system32\bootvidgj.dll
c:\windows.0\system32\nwapi32dj.dll
c:\windows.0\system32\tscfgwmijxsj.dll
c:\windows.0\system32\cliconfgzx.dll
c:\windows.0\system32\adsntzt.dll
c:\windows.0\system32\dispexcb.dll
c:\program files\internet explorer\exploremt.456
c:\program files\internet explorer\7654321t.321
c:\program files\internet explorer\plugins\321nt64.987
c:\windows.0\fonts\apsghjba.dll
c:\windows.0\system32\dllcache\wuauclt.exe
c:\program files\microsoft office\system\apcdli.sys
c:\documents and settings\all users.windows.0\application data\microsoft\media player\obj\wmpobj.sys
c:\windows\system32\drivers\hbkernel.sys
c:\windows\system32\drivers\hbkernel.sys
c:\windows.0\system32\dbeaf7d.sys
c:\windows.0\system32\byqpxay.tmp
———————————————————————————————————————
重启计算机后会看到一个请选择要启动的操作系统的提示，倒计时5秒，
第一个选项是你自己的Windows系统，
第二个选项是XDelBox的Go XDelBox To Del Files，
默认自动选择第二项，会进入类似DOS的界面，
这期间什么操作都不用做，等待它自动运行即可，
待病毒文件删除后会自动重启进入Windows系统，
然后再按以下步骤操作：
———————————————————————————————————————
删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[twainyy.dll] <C:\WINDOWS.0\system32\twainyy.dll>
[lweurqhx.dll] <C:\WINDOWS.0\system32\lweurqhx.dll>
[dpvvoxmh.dll] <C:\WINDOWS.0\system32\dpvvoxmh.dll>
[avicapwm.dll] <C:\WINDOWS.0\system32\avicapwm.dll>
[pgugrtqe.dll] <C:\WINDOWS.0\system32\pgugrtqe.dll>
[certmgrkd.dll] <C:\WINDOWS.0\system32\certmgrkd.dll>
[imgutilhx2.dll] <C:\WINDOWS.0\system32\imgutilhx2.dll>
[xolehlpjh.dll] <C:\WINDOWS.0\system32\xolehlpjh.dll>
[slbiopfs2.dll] <C:\WINDOWS.0\system32\slbiopfs2.dll>
[bootvidgj.dll] <C:\WINDOWS.0\system32\bootvidgj.dll>
[nwapi32dj.dll] <C:\WINDOWS.0\system32\nwapi32dj.dll>
[tscfgwmijxsj.dll] <C:\WINDOWS.0\system32\tscfgwmijxsj.dll>
[cliconfgzx.dll] <C:\WINDOWS.0\system32\cliconfgzx.dll>
[adsntzt.dll] <C:\WINDOWS.0\system32\adsntzt.dll>
[dispexcb.dll] <C:\WINDOWS.0\system32\dispexcb.dll>
[{79058C97-6141-4E03-874B-0055FA21E36A}] <C:\Program Files\Internet Explorer\ExploreMt.456>
[{6A1C6F99-5C00-41F2-99AE-44CE09DB5B6E}] <C:\Program Files\Internet Explorer\7654321t.321>
[{48691221-F05C-4AB4-B9D0-50D6D36CC27F}] <C:\Program Files\Internet Explorer\PLUGINS\321Nt64.987>
[{434FA69C-5F0A-42e1-82B8-10AF2C8E53C6}] <C:\WINDOWS.0\system32\twainyy.dll>
[{71A78CD4-E470-4a18-8457-E0E0283DD507}] <C:\WINDOWS.0\system32\lweurqhx.dll>
[{2876D76C-CAAA-4313-AF97-8D1D9A2A1087}] <C:\WINDOWS.0\system32\dpvvoxmh.dll>
[{6B9FEAD7-4319-4312-AB05-D8C9CD255BFE}] <C:\WINDOWS.0\system32\avicapwm.dll>
[{21BE5FDF-D4CB-4850-AD99-21E68B50BF3F}] <C:\WINDOWS.0\system32\pgugrtqe.dll>
[{9FD45A54-9875-698F-E56E-65102358FDF9}] <C:\WINDOWS.0\Fonts\apsghjba.dll>
[{9E8287B0-0F3A-48ae-99C5-A6E0AAC36BC5}] <C:\WINDOWS.0\system32\certmgrkd.dll>
[{DA56B183-A731-402b-9235-2CB8803E212D}] <C:\WINDOWS.0\system32\imgutilhx2.dll>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WOPTILITIES.EXE]] <IFEO[WOPTILITIES.EXE]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe]] <IFEO[SmartUp.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderml.exe]] <IFEO[spiderml.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spidernt.exe]] <IFEO[spidernt.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spiderui.exe]] <IFEO[spiderui.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spml_set.exe]] <IFEO[spml_set.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREng.EXE]] <IFEO[SREng.EXE]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SREngLdr.EXE]] <IFEO[SREngLdr.EXE]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sunesnk.exe]] <IFEO[sunesnk.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe]] <IFEO[symlcsvc.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SysSafe.exe]] <IFEO[SysSafe.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgar.exe]] <IFEO[taskmgar.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojanDetector.exe]] <IFEO[TrojanDetector.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe]] <IFEO[Trojanwall.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.kxp]] <IFEO[TrojDie.kxp]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe]] <IFEO[UIHost.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAgent.exe]] <IFEO[UmxAgent.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe]] <IFEO[UmxAttachment.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxCfg.exe]] <IFEO[UmxCfg.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxFwHlp.exe]] <IFEO[UmxFwHlp.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxPol.exe]] <IFEO[UmxPol.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.exe]] <IFEO[UpLive.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPC32.EXE]] <IFEO[VPC32.EXE]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VPTRAY.EXE]] <IFEO[VPTRAY.EXE]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vsstat.exe]] <IFEO[vsstat.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webscanx.exe]] <IFEO[webscanx.exe]>
[[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WoptiClean.exe]] <IFEO[WoptiClean.exe]>
[IFEO[360rpt.EXE]] <ntsd -d>
[IFEO[360safe.EXE]] <ntsd -d>
[IFEO[360safebox.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[360tray.EXE]] <ntsd -d>
[IFEO[adam.exe]] <ntsd -d>
[IFEO[AgentSvr.exe]] <ntsd -d>
[IFEO[ANTIARP.EXE]] <ntsd -d>
[IFEO[AppSvc32.exe]] <ntsd -d>
[IFEO[ArSwp.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[Ast.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[AutoRunKiller.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[autoruns.exe]] <ntsd -d>
[IFEO[avconsol.exe]] <ntsd -d>
[IFEO[avgrssvc.exe]] <ntsd -d>
[IFEO[AvMonitor.EXE]] <ntsd -d>
[IFEO[AVP.COM]] <ntsd -d>
[IFEO[AVP.EXE]] <ntsd -d>
[IFEO[CCenter.EXE]] <ntsd -d>
[IFEO[ccSvcHst.exe]] <ntsd -d>
[IFEO[DrvAnti.exe]] <ntsd -d>
[IFEO[drwadins.exe]] <ntsd -d>
[IFEO[drwebscd.exe]] <ntsd -d>
[IFEO[drwebupw.exe]] <ntsd -d>
[IFEO[EGHOST.exe]] <ntsd -d>
[IFEO[FileDsty.exe]] <ntsd -d>
[IFEO[filemon.exe]] <ntsd -d>
[IFEO[Frameworkservice.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[FTCleanerShell.exe]] <ntsd -d>
[IFEO[FYFireWall.exe]] <ntsd -d>
[IFEO[GFRing3.exe]] <ntsd -d>
[IFEO[GFUpd.EXE]] <ntsd -d>
[IFEO[GuardField.EXE]] <ntsd -d>
[IFEO[HijackThis.exe]] <ntsd -d>
[IFEO[IceSword.EXE]] <ntsd -d>
[IFEO[iparmo.exe]] <ntsd -d>
[IFEO[Iparmor.EXE]] <ntsd -d>
[IFEO[isPwdSvc.exe]] <ntsd -d>
[IFEO[kabaload.exe]] <ntsd -d>
[IFEO[KASARP.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[KaScrScn.SCR]] <ntsd -d>
[IFEO[KASMain.exe]] <ntsd -d>
[IFEO[KASTask.exe]] <ntsd -d>
[IFEO[KAV32.exe]] <ntsd -d>
[IFEO[KAVDX.exe]] <ntsd -d>
[IFEO[KAVPF.exe]] <ntsd -d>
[IFEO[KAVPFW.EXE]] <ntsd -d>
[IFEO[KAVSetup.exe]] <ntsd -d>
[IFEO[kavstart.EXE]] <ntsd -d>
[IFEO[KISLnchr.exe]] <ntsd -d>
[IFEO[kmailmon.EXE]] <ntsd -d>
[IFEO[KMFilter.exe]] <ntsd -d>
[IFEO[KPFW32.exe]] <ntsd -d>
[IFEO[KPFW32X.exe]] <ntsd -d>
[IFEO[KPfwSvc.exe]] <ntsd -d>
[IFEO[KRegEx.EXE]] <ntsd -d>
[IFEO[KRepair.com]] <ntsd -d>
[IFEO[KsLoader.exe]] <ntsd -d>
[IFEO[KVCenter.kxp]] <ntsd -d>
[IFEO[KvDetect.exe]] <ntsd -d>
[IFEO[KvfwMcl.exe]] <ntsd -d>
[IFEO[KVMonxp.KXP]] <ntsd -d>
[IFEO[KVMonXP_1.kxp]] <ntsd -d>
[IFEO[kvol.exe]] <ntsd -d>
[IFEO[kvolself.exe]] <ntsd -d>
[IFEO[KvReport.kxp]] <ntsd -d>
[IFEO[KVScan.kxp]] <ntsd -d>
[IFEO[KVSrvXP.EXE]] <ntsd -d>
[IFEO[KVStub.kxp]] <ntsd -d>
[IFEO[kvupload.exe]] <ntsd -d>
[IFEO[KVWSC.EXE]] <ntsd -d>
[IFEO[KvXP.kxp]] <ntsd -d>
[IFEO[KvXP_1.kxp]] <ntsd -d>
[IFEO[kwatch.EXE]] <ntsd -d>
[IFEO[KWatch9x.exe]] <ntsd -d>
[IFEO[KWatchX.exe]] <ntsd -d>
[IFEO[MagicSet.exe]] <ntsd -d>
[IFEO[mcconsol.exe]] <ntsd -d>
[IFEO[mmqczj.exe]] <ntsd -d>
[IFEO[Mmsk.EXE]] <ntsd -d>
[IFEO[msconfig.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[Navapsvc.EXE]] <ntsd -d>
[IFEO[Navapw32.exe]] <ntsd -d>
[IFEO[nod32.exe]] <ntsd -d>
[IFEO[nod32krn.EXE]] <ntsd -d>
[IFEO[Nod32kui.EXE]] <ntsd -d>
[IFEO[NPFMntor.exe]] <ntsd -d>
[IFEO[OllyDBG.EXE]] <ntsd -d>
[IFEO[OllyICE.EXE]] <ntsd -d>
[IFEO[PFW.exe]] <ntsd -d>
[IFEO[PFWLiveUpdate.exe]] <ntsd -d>
[IFEO[procexp.exe]] <ntsd -d>
[IFEO[QHSET.exe]] <ntsd -d>
[IFEO[QQDoctor.exe]] <ntsd -d>
[IFEO[QQKav.exe]] <ntsd -d>
[IFEO[Ras.exe]] <ntsd -d>
[IFEO[RAV.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[RavCopy.exe]] <ntsd -d>
[IFEO[RavMon.exe]] <ntsd -d>
[IFEO[RavMonD.exe]] <ntsd -d>
[IFEO[RavStub.EXE]] <ntsd -d>
[IFEO[RavTask.exe]] <ntsd -d>
[IFEO[RavXP.exe]] <ntsd -d>
[IFEO[RawCopy.exe]] <ntsd -d>
[IFEO[RegClean.exe]] <ntsd -d>
[IFEO[Regedit.EXE]] <ntsd -d>
[IFEO[regmon.exe]] <ntsd -d>
[IFEO[RegTool.exe]] <ntsd -d>
[IFEO[rfwcfg.exe]] <ntsd -d>
[IFEO[rfwmain.EXE]] <ntsd -d>
[IFEO[rfwProxy.EXE]] <ntsd -d>
[IFEO[rfwsrv.EXE]] <ntsd -d>
[IFEO[rfwstub.EXE]] <ntsd -d>
[IFEO[RsAgent.exe]] <ntsd -d>
[IFEO[Rsaupd.exe]] <ntsd -d>
[IFEO[Runiep.EXE]] <ntsd -d>
[IFEO[safeboxTray.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
[IFEO[safelive.exe]] <ntsd -d>
[IFEO[scan32.exe]] <ntsd -d>
[IFEO[shcfg32.exe]] <ntsd -d>
[C:\WINDOWS.0\system32\twainyy.dll] <>
[C:\WINDOWS.0\system32\lweurqhx.dll] <>
[C:\WINDOWS.0\system32\dpvvoxmh.dll] <>
[C:\WINDOWS.0\system32\avicapwm.dll] <>
[C:\WINDOWS.0\system32\pgugrtqe.dll] <>
[C:\WINDOWS.0\system32\certmgrkd.dll] <>
[C:\WINDOWS.0\system32\imgutilhx2.dll] <>
[C:\WINDOWS.0\system32\xolehlpjh.dll] <>
[C:\WINDOWS.0\system32\slbiopfs2.dll] <>
[C:\WINDOWS.0\system32\bootvidgj.dll] <>
[C:\WINDOWS.0\system32\nwapi32dj.dll] <>
[C:\WINDOWS.0\system32\tscfgwmijxsj.dll] <>
[C:\WINDOWS.0\system32\cliconfgzx.dll] <>
[C:\WINDOWS.0\system32\adsntzt.dll] <>
[C:\WINDOWS.0\system32\dispexcb.dll] <>
[C:\Program Files\Internet Explorer\ExploreMt.456] <>
[C:\Program Files\Internet Explorer\7654321t.321] <>
[C:\Program Files\Internet Explorer\PLUGINS\321Nt64.987] <>
[C:\WINDOWS.0\system32\twainyy.dll] <>
[C:\WINDOWS.0\system32\lweurqhx.dll] <>
[C:\WINDOWS.0\system32\dpvvoxmh.dll] <>
[C:\WINDOWS.0\system32\avicapwm.dll] <>
[C:\WINDOWS.0\system32\pgugrtqe.dll] <>
[C:\WINDOWS.0\Fonts\apsghjba.dll] <>
[C:\WINDOWS.0\system32\certmgrkd.dll] <>
[C:\WINDOWS.0\system32\imgutilhx2.dll] <>
[IFEO[WOPTILITIES.EXE]] <C:\WINDOWS.0\system32\dllcache\wuauclt.exe>
启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[apcdli / apcdli] <\??\C:\Program Files\Microsoft Office\SYSTEM\apcdli.sys>
[wmpobj / wmpobj] <\??\C:\Documents and Settings\All Users.WINDOWS.0\Application Data\Microsoft\Media Player\obj\wmpobj.sys>
[HBKernel Driver / HBKernel] <\SystemRoot\system32\DRIVERS\HBKernel.sys>
[HBKernel Driver / HBKernel] <\SystemRoot\system32\DRIVERS\HBKernel.sys>
[dbeaf7d / dbeaf7d] <\??\C:\WINDOWS.0\system32\dbeaf7d.sys>
[byqpxay / byqpxay] <\??\C:\WINDOWS.0\system32\byqpxay.tmp>
———————————————————————————————————————
最后用Windows清理助手清理你的系统
【Windows清理助手使用帮助
http://www.arswp.com/help.html】
将杀毒软件升级到最新版本，断开网络连接，全盘彻底查杀病毒
———————————————————————————————————————
