用sreng
删除启动项目=>注册表
<><C:\WINDOWS\system32\dllcache\Default.exe> []
<><C:\WINDOWS\system\KEYBOARD.exe> []
<><C:\WINDOWS\system32\dllcache\Default.exe> []
<sys><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\auto.exe]
<IFEO[auto.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autorun.exe]
<IFEO[autorun.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe]
<IFEO[autoruns.exe]><C:\WINDOWS\system32\drivers\drivers.cab.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe]
<IFEO[boot.exe]><C:\WINDOWS\Fonts\fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ctfmon.exe]
<IFEO[ctfmon.exe]><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe]
<IFEO[msconfig.exe]><C:\WINDOWS\Media\rndll32.pif> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessManager.exe]
<IFEO[ProcessManager.exe]><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe]
<IFEO[procexp.exe]><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe]
<IFEO[rundll32.exe]><C:\WINDOWS\Fonts\Fonts.exe> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe]
<IFEO[taskmgr.exe]><C:\WINDOWS\Fonts\tskmgr.exe> []
[HKEY_CURRENT_USER\Control Panel\Desktop]
<SCRNSAVE.EXE><C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com> []
重启,删除
C:\WINDOWS\system32\drivers\drivers.cab.exe
C:\WINDOWS\Media\rndll32.pif
C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.com
C:\WINDOWS\system32\dllcache\Default.exe
C:\WINDOWS\system\KEYBOARD.exe
C:\WINDOWS\system32\dllcache\Default.exe
C:\WINDOWS\Fonts\Fonts.exe
用winrar 删除 每个盘符下的
Autorun.inf 和 MS-DOS.com 文件..
