操作前强烈要求先断网1.建议使用XDelBox删除以下文件:(Xdelbox1.8下载地址:
http://www.dodudou.com/down/inde ... C8%ED%BC%FE&order=0)
使用说明:
先勾选抑制再生,
删除时复制所有要删除文件的路径,在待删除文件列表里点击右键选择从剪贴板导入不检查路径,导入后在要删除文件上点击右键,选择立刻重启删除(不论文件是否存在,继续操作重启删除
),电脑会重启进入DOS界面进行删除操作。
运行xdelbox前最好卸载所有可移动存储介质(包括U盘,MP3,手机存储卡等)。 c:\docume~1\admini~1\locals~1\temp\157.tmp
c:\docume~1\admini~1\locals~1\temp\118.tmp
c:\windows\system32\biroask.exe
c:\windows\system32\08223b03.dll
c:\windows\system32\122b901e.dll
c:\windows\system32\22d75360.dll
c:\windows\system32\3474a8c2.dll
c:\windows\system32\495271ca.dll
c:\windows\system32\4bf9cba3.dll
c:\windows\system32\4d023de9.dll
c:\windows\system32\58ff3024.dll
c:\windows\system32\8566f82e.dll
c:\windows\system32\b3721c07.dll
c:\windows\system32\boarxbby.dll
c:\windows\system32\bqnrlgfk.dll
c:\windows\system32\c250cf20.dll
c:\windows\system32\c56bcc10.dll
c:\windows\system32\da63e650.dll
c:\windows\system32\frxatocn.dll
c:\windows\system32\fyuszphk.dll
c:\windows\system32\hdqeebuy.dll
c:\windows\system32\knpislxf.dll
c:\windows\system32\pomtbygq.dll
c:\windows\system32\shlonzdj.dll
c:\windows\system32\tzigtcfb.dll
c:\windows\system32\uaxvqrjm.dll
c:\windows\system32\upibkpsc.dll
c:\windows\system32\wbhppzuh.dll
c:\windows\system32\wivjzxmc.dll
c:\windows\system32\system.exe
c:\windows\system32\hbdnf.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\hbso2.dll
c:\windows\system32\hbtl.dll
c:\windows\system32\hbtw2.dll
c:\docume~1\admini~1\locals~1\temp\wowinitcode.dat
c:\windows\system32\fpnufrsx.dll
c:\windows\system32\bfsudeml.dll
c:\windows\system32\kjfkegvo.dll
c:\windows\system32\abdmonxf.dll
c:\windows\system32\zlrwd0810.dll
c:\windows\system32\8b52f47.sys
c:\windows\system32\4901228.sys
c:\windows\system32\c551839.sys
c:\windows\system32\drivers\hbkernel32.sys
2.删除重启后使用SREng修复下面各项: 启动项目 -- 注册表之如下项删除:
[fpnufrsx.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[bfsudeml.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[kjfkegvo.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[abdmonxf.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[pomtbygq.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[shlonzdj.dll] <C:\WINDOWS\system32\shlonzdj.dll>
[bqnrlgfk.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[knpislxf.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[wbhppzuh.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[frxatocn.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[fyuszphk.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[boarxbby.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[upibkpsc.dll] <C:\WINDOWS\system32\shlonzdj.dll>
[uaxvqrjm.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[hdqeebuy.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[tzigtcfb.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[kvgcccsf.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[njmuyhjs.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[phogqozi.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[qgebgwda.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[jphplbhr.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[pcptznou.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[iwpbtviv.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[loggswgd.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[hwdghiar.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[ctpfhtio.dll] <C:\WINDOWS\system32\shlonzdj.dll>
[biefmcol.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[yxvlfmrp.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[aeajievt.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[wtjpboyp.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[wpjvjunc.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[pkjcebqd.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[yhznowos.dll] <C:\WINDOWS\system32\shlonzdj.dll>
[ywnntftp.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[divrijaz.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[gpxdaqiw.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[dmrpvyvj.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[flivuhtq.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[shswijeu.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[khwgglik.dll] <C:\WINDOWS\system32\shlonzdj.dll>
[mznleugr.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[cqlfobqi.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[lnvwnghv.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[lujosona.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[kjyoyxsx.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[hvdhodxr.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[tiedboou.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[wivjzxmc.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[fbtfdgev.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[fiifiokr.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[bncsvoxd.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[raanxwkh.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[rtxhcyas.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[qpxflfpe.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[mkiobqzh.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[mrfogzfd.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[yzbdymxj.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[uosjqxag.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[kgqladcw.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[aqonkjfn.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[wyitxldm.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[jcbdlmoq.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[qgqsqmsh.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[wibdhoia.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[iqfsycsg.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[bkfzbjnh.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[yedaqpsj.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[orbwspfn.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[hpbxmqkc.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[utmgjzvf.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[kxtotfmi.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[mpjtrgkp.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[sjjxgsrs.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[bgthmxjn.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[ylntzfez.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[uxluplab.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[dqjrtutu.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[giawjvrb.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[pmpskjqc.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[vnadtthu.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[hvdzszra.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[qsfjreqv.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[grordqct.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[brxhnswo.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[htqsdcmo.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[kohrtfvj.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[bnwvtmjk.dll] <C:\WINDOWS\system32\bqnrlgfk.dll>
[eqnurpkn.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[jzuffzgc.dll] <C:\WINDOWS\system32\fpnufrsx.dll>
[spkijhwh.dll] <C:\WINDOWS\system32\bfsudeml.dll>
[fdaldspd.dll] <C:\WINDOWS\system32\kjfkegvo.dll>
[ybsmxtvs.dll] <C:\WINDOWS\system32\abdmonxf.dll>
[widoicwc.dll] <C:\WINDOWS\system32\pomtbygq.dll>
[eddwodlk.dll] <C:\WINDOWS\system32\wivjzxmc.dll>
[{DC6ED3B4-D07A-4f04-9D41-0E6701C0BD09}] <C:\WINDOWS\system32\shlonzdj.dll>
[{EA4D8F95-8F2E-4658-A234-E8F4C9AC21C5}] <C:\WINDOWS\system32\bqnrlgfk.dll>
[{C56BCC10-503E-43AB-B208-3CD37FCFCE40}] <C56BCC10.dll>
[{B3721C07-62B3-411A-9DC7-F5F27E3E21FF}] <B3721C07.dll>
[{22D75360-199D-4F79-880D-82E766675F06}] <22D75360.dll>
[{AF976DCD-754F-4ac2-BE49-951DC7AA57D2}] <C:\WINDOWS\system32\knpislxf.dll>
[{4D023DE9-F4B5-4BE0-99C6-7C7AD0CF5426}] <4D023DE9.dll>
[{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}] <08223B03.dll>
[{DA63E650-537C-4042-87BB-9D19D844680B}] <DA63E650.dll>
[{432BDC7C-DE5B-43f4-AA81-E7F8AFB0182D}] <C:\WINDOWS\system32\bfsudeml.dll>
[{3474A8C2-BEF9-46C8-983A-A26A0030EC30}] <3474A8C2.dll>
[{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}] <4BF9CBA3.dll>
[{8566F82E-03A4-416E-AEAC-66600D8881F1}] <8566F82E.dll>
[{2CB77746-8ECC-40ca-8217-10CA8BE5EFC8}] <C:\WINDOWS\system32\kjfkegvo.dll>
[{D1CC9DC6-F0BC-40fc-9552-E497B05E05B8}] <C:\WINDOWS\system32\abdmonxf.dll>
[{DA56B183-A731-402b-9235-2CB8803E212D}] <C:\WINDOWS\system32\wivjzxmc.dll>
[{495271CA-D0C6-4052-ABE6-5B01C73CDFB0}] <495271CA.dll>
[{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}] <122B901E.dll>
[{C250CF20-5F89-4310-9854-4BC261FB14FB}] <C250CF20.dll>
[{58FF3024-8A83-4B1A-88E9-302F47646EEE}] <58FF3024.dll>
[{F0930A2F-D971-4828-8209-B7DFD266ED44}] <C:\WINDOWS\system32\pomtbygq.dll>
注意该项[AppInit_DLLs]修改:把<biroas.dll>修改为<>即清空
[Start] <rundll32.exe C:\WINDOWS\system32\zlrwd0810.dll,Hook>
启动项目 -- 服务-- 驱动程序之如下项禁用:
[8b52f47 / 8b52f47] <\??\C:\WINDOWS\system32\8b52f47.sys>
[4901228 / 4901228] <\??\C:\WINDOWS\system32\4901228.sys>
[c551839 / c551839] <\??\C:\WINDOWS\system32\c551839.sys>
[HBKernel32 Driver / HBKernel32] <\SystemRoot\system32\drivers\HBKernel32.sys>
WINDOWS目录里的Explorer.EXE被病毒替换
从正常XP-SP的计算机里拷个Explorer
放进去