断网
1.建议使用XDelBox删除以下文件
c:\windows\system32\system.exe
c:\windows\system32\118851f1.dll
c:\windows\system32\hbasktao.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\hbqqsg.dll
c:\windows\system32\hbtl.dll
c:\windows\system32\hbwd.dll
c:\windows\system32\hbwow.dll
c:\windows\system32\hbyy.dll
c:\windows\temp\wmsetup.dll
c:\docume~1\admini~1\locals~1\temp\wmsetup.dll
c:\windows\fonts\framdee.ttf
c:\windows\system32\08223b03.dll
c:\windows\system32\122b901e.dll
c:\windows\system32\1fd51f1f.dll
c:\windows\system32\2ef0d734.dll
c:\windows\system32\3d144530.dll
c:\windows\system32\4d023de9.dll
c:\windows\system32\93dee065.dll
c:\windows\system32\9ca963ca.dll
c:\windows\system32\a1a6bc2e.dll
c:\windows\system32\a55f538e.dll
c:\windows\system32\b6e23e89.dll
c:\windows\system32\c8ffd223.dll
c:\windows\system32\d9c002dd.dll
c:\windows\system32\da63e650.dll
c:\windows\system32\dfb3dac5.dll
c:\windows\system32\ffae967f.dll
c:\windows\mkmkrnl.dll
c:\windows\update.dll
c:\windows\mpkrnl.dll
c:\windows\system32\755d0ed0.dll
c:\windows\system32\b160485.sys
c:\windows\system32\b1a18a3e.sys
c:\windows\system32\b71fe93.sys
c:\program files\rising\rav\hookreg.sys
c:\windows\system32\drivers\hbkernel32.sys
c:\windows\system32\f28907d.sys
2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[118851F1] <C:\WINDOWS\system32\118851F1.dll>
[{3D144530-43DA-47CC-B7C7-A3A9F3B9A6B2}] <3D144530.dll>
[{1FD51F1F-97E4-498C-AB12-93332EEAD266}] <1FD51F1F.dll>
[{93DEE065-EC9B-4505-ADD3-19880AD3C38F}] <93DEE065.dll>
[{118851F1-60F5-49E1-B5A9-8739FDAE1FFE}] <C:\WINDOWS\system32\118851F1.dll>
[{DA63E650-537C-4042-87BB-9D19D844680B}] <DA63E650.dll>
[{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}] <A1A6BC2E.dll>
[{9CA963CA-107C-4089-B0AB-31380F90D7E3}] <9CA963CA.dll>
[{FFAE967F-D0FC-4D2B-A0F5-D1BF27F46418}] <FFAE967F.dll>
[{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}] <122B901E.dll>
[{A55F538E-9E65-4706-9458-852BF6592063}] <A55F538E.dll>
[{B6E23E89-C925-4BF7-92EB-77EFDF8C58A6}] <B6E23E89.dll>
[{D9C002DD-EA51-43A2-9009-54EAAAF031A4}] <D9C002DD.dll>
[{C8FFD223-C0FB-40C5-94A0-FD7891AC18E9}] <C8FFD223.dll>
[{2EF0D734-21FD-4225-A1A2-BCD296182AAF}] <2EF0D734.dll>
[{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}] <08223B03.dll>
[{4D023DE9-F4B5-4BE0-99C6-7C7AD0CF5426}] <4D023DE9.dll>
[{DFB3DAC5-B0B5-4B05-BFCF-FB42737778FA}] <DFB3DAC5.dll>
注意该项[AppInit_DLLs]修改：把<HBYY.dll,HBmhly.dll,HBQQSG.dll,HBWD.dll,HBTL.dll,HBASKTAO.dll,HBWOW.dll,118851F1.dll,kmon.dll>修改为<kmon.dll>
[MPMKrnl] <rundll32 "C:\WINDOWS\MKMKrnl.dll",KMainProc>
[HBService32] <System.exe>
[MPKrnl] <rundll32 "C:\WINDOWS\MPKrnl.dll",KrnlMsgProc>
[3PMmUpdate] <rundll32 "C:\WINDOWS\Update.dll",Main>
[{755D0ED0-3996-4ADB-9B1F-AD8F0E9E4738}] <755D0ED0.dll>
启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[b160485 / b160485] <\??\C:\WINDOWS\system32\b160485.sys>
[b1a18a3e / b1a18a3e] <\??\C:\WINDOWS\system32\b1a18a3e.sys>
[b71fe93 / b71fe93] <\??\C:\WINDOWS\system32\b71fe93.sys>
[HookReg / HookReg] <\??\C:\Program Files\Rising\Rav\HookReg.sys>
[HBKernel32 Driver / HBKernel32] <\SystemRoot\system32\drivers\HBKernel32.sys>
[f28907d / f28907d] <\??\C:\WINDOWS\system32\f28907d.sys>
下载IFEO映像挟持修复程序
http://www.kingzoo.com/bbs/attac ... fa&t=1221930665
下载windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.rar（升级后使用）
关闭IE用下面的工具全选，清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe 杀毒软件重装,升级杀毒,打好系统补丁
