机子中毒了，请求帮助

症状：（自己查杀后仍存在1-4条的问题）
1.ie打开后，所有的连接都打不开
2.复制粘贴，不管用了，包括快捷键
3.菜单栏点右键，不管用，出来的菜单和点击小键盘出的菜单一样
4.运行 gpedit.msc 出来的窗口 在服务部分 有一篇蓝色区域，无法操作
5.杀毒软件失效，自己查杀了部分病毒后，瑞星杀毒软件仍失效，卡卡仍失效，防火墙后来可以运行正常
6.windows清理助手界面被更改成某论坛连接，后来杀部分可运行
7.360等无法运行，杀部分后可运行
自己查了一下

杀出部分病毒
检出过 机器狗病毒

但联网后病毒又回来了
病毒报告是我 用光盘启动后移出来的

用户系统信息：Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

是木马群

手工杀毒难度比较大

原因重装系统么？
不愿意的话
我可以提供解决方法

该用户帖子内容已被屏蔽

基本无效
没抓住病根

参照
http://bbs.ikaka.com/showtopic-8561436.aspx
替换本机c:\windows\system32\userinit.EXE和
c:\windows\system32\rpcss.dll
正确替换后


1.建议使用XDelBox删除以下文件： Xdelbox1.8下载地址
使用说明：先勾选抑制再生，删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择从剪贴板导入不检查路径，导入后在要删除文件上点击右键，选择立刻重启删除(不论文件是否存在，继续操作重启删除
)，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储介质（包括U盘，MP3，手机存储卡等）。



c:\windows\system32\sh14038.dll
c:\windows\system32\sh27013.dll
c:\windows\system32\csrss.dll
c:\windows\system32\068ea51c.dll
c:\windows\system32\0b402387.dll
c:\windows\system32\136ba812.dll
c:\windows\system32\16560263.dll
c:\windows\system32\17788d2d.dll
c:\windows\system32\17bfb15d.dll
c:\windows\system32\19fe4542.dll
c:\windows\system32\20d009ed.dll
c:\windows\system32\2625370f.dll
c:\windows\system32\3d2e07d3.dll
c:\windows\system32\3e1732f5.dll
c:\windows\system32\3f082d15.dll
c:\windows\system32\4b341b15.dll
c:\windows\system32\4c7c3d86.dll
c:\windows\system32\4e5b6f21.dll
c:\windows\system32\653477e7.dll
c:\windows\system32\69d1993f.dll
c:\windows\system32\7803fa25.dll
c:\windows\system32\83e9fd38.dll
c:\windows\system32\94732f54.dll
c:\windows\system32\9593f4d8.dll
c:\windows\system32\ad1eade2.dll
c:\windows\system32\afmchknb.dll
c:\windows\system32\b6a4d893.dll
c:\windows\system32\b72c31f3.dll
c:\windows\system32\b9e299f7.dll
c:\windows\system32\c2515274.dll
c:\windows\system32\c5c0bac0.dll
c:\windows\system32\c5ed317c.dll
c:\windows\system32\ca82ffb6.dll
c:\windows\system32\ceaf3f5f.dll
c:\windows\system32\d2fac6aa.dll
c:\windows\system32\d6f730a5.dll
c:\windows\system32\ddngfdgp.dll
c:\windows\system32\e4ce11f7.dll
c:\windows\system32\enpmnpfa.dll
c:\windows\system32\f0870926.dll
c:\windows\system32\f5f2c0be.dll
c:\windows\system32\hbasktao.dll
c:\windows\system32\hbchibi.dll
c:\windows\system32\hbjtlq.dll
c:\windows\system32\hbkdxy.dll
c:\windows\system32\hbmhly.dll
c:\windows\system32\hbwd.dll
c:\windows\system32\hbwow.dll
c:\windows\system32\hbxmj.dll
c:\windows\system32\hbzg.dll
c:\windows\system32\hbzhuxian.dll
c:\windows\system32\ifdmcogk.dll
c:\windows\system32\jomfmmjb.dll
c:\windows\system32\pihhmkej.dll
c:\program files\internet explorer\sys6ntme.zys
c:\program files\internet explorer\sysnetnt.sys
c:\windows\system32\08223b03.dll
c:\windows\system32\122b901e.dll
c:\windows\system32\133aeac9.dll
c:\windows\system32\201476d0.dll
c:\windows\system32\2ef0d734.dll
c:\windows\system32\34a25f04.dll
c:\windows\system32\4fbfd5a4.dll
c:\windows\system32\56bc86c7.dll
c:\windows\system32\5934ea2b.dll
c:\windows\system32\66afcb56.dll
c:\windows\system32\9ca963ca.dll
c:\windows\system32\a1a6bc2e.dll
c:\windows\system32\ba7edf54.dll
c:\windows\system32\c8ffd223.dll
c:\windows\system32\da63e650.dll
c:\windows\system32\dfb3dac5.dll
c:\windows\system32\e0d39066.dll
c:\windows\system32\e1384213.dll
c:\windows\system32\e1d19fcc.dll
c:\windows\system32\e4814792.dll
c:\windows\system32\smxd011.dll
C:\WINDOWS\SYSTEM32\SYSTEM.EXE
c:\windows\system32\drivers\hbkernel32.sys
c:\windows\system32\drivers\hbkernel32.sys
c:\windows\system32\f28907d.sys
c:\windows\system32\f35ee9e.sys
c:\windows\system32\d812a079.sys
c:\windows\system32\b1a18a3e.sys
c:\windows\system32\b160485.sys
c:\windows\system32\drivers\aliimz.sys
c:\windows\system32\6457aed.sys

2.删除重启后使用SREng修复下面各项：

    启动项目 －－ 注册表之如下项删除：
[9593F4D8]    <C:\WINDOWS\system32\9593F4D8.dll>
[DD70FD09]    <C:\WINDOWS\system32\ddngfdgp.dll>
[AD1EADE2]    <C:\WINDOWS\system32\AD1EADE2.dll>
[386F663B]    <C:\WINDOWS\system32\jomfmmjb.dll>
[E79679FA]    <C:\WINDOWS\system32\enpmnpfa.dll>
[B9E299F7]    <C:\WINDOWS\system32\B9E299F7.dll>
[136BA812]    <C:\WINDOWS\system32\136BA812.dll>
[2FD6C804]    <C:\WINDOWS\system32\ifdmcogk.dll>
[83E9FD38]    <C:\WINDOWS\system32\83E9FD38.dll>
[C5ED317C]    <C:\WINDOWS\system32\C5ED317C.dll>
[7803FA25]    <C:\WINDOWS\system32\7803FA25.dll>
[4C7C3D86]    <C:\WINDOWS\system32\4C7C3D86.dll>
[AF6C147B]    <C:\WINDOWS\system32\afmchknb.dll>
[2625370F]    <C:\WINDOWS\system32\2625370F.dll>
[921164E3]    <C:\WINDOWS\system32\pihhmkej.dll>
[CA82FFB6]    <C:\WINDOWS\system32\CA82FFB6.dll>
[0B402387]    <C:\WINDOWS\system32\0B402387.dll>
[17BFB15D]    <C:\WINDOWS\system32\17BFB15D.dll>
[4E5B6F21]    <C:\WINDOWS\system32\4E5B6F21.dll>
[E4CE11F7]    <C:\WINDOWS\system32\E4CE11F7.dll>
[D2FAC6AA]    <C:\WINDOWS\system32\D2FAC6AA.dll>
[20D009ED]    <C:\WINDOWS\system32\20D009ED.dll>
[F0870926]    <C:\WINDOWS\system32\F0870926.dll>
[69D1993F]    <C:\WINDOWS\system32\69D1993F.dll>
[C5C0BAC0]    <C:\WINDOWS\system32\C5C0BAC0.dll>
[3F082D15]    <C:\WINDOWS\system32\3F082D15.dll>
[19FE4542]    <C:\WINDOWS\system32\19FE4542.dll>
[17788D2D]    <C:\WINDOWS\system32\17788D2D.dll>
[4B341B15]    <C:\WINDOWS\system32\4B341B15.dll>
[F5F2C0BE]    <C:\WINDOWS\system32\F5F2C0BE.dll>
[CEAF3F5F]    <C:\WINDOWS\system32\CEAF3F5F.dll>
[B6A4D893]    <C:\WINDOWS\system32\B6A4D893.dll>
[653477E7]    <C:\WINDOWS\system32\653477E7.dll>
[C2515274]    <C:\WINDOWS\system32\C2515274.dll>
[3E1732F5]    <C:\WINDOWS\system32\3E1732F5.dll>
[068EA51C]    <C:\WINDOWS\system32\068EA51C.dll>
[94732F54]    <C:\WINDOWS\system32\94732F54.dll>
[16560263]    <C:\WINDOWS\system32\16560263.dll>
[3D2E07D3]    <C:\WINDOWS\system32\3D2E07D3.dll>
[D6F730A5]    <C:\WINDOWS\system32\D6F730A5.dll>
[B72C31F3]    <C:\WINDOWS\system32\B72C31F3.dll>
[{9593F4D8-5104-428F-9C59-1F9CA722FE26}]    <C:\WINDOWS\system32\9593F4D8.dll>
[{DD70FD09-4CFD-4D59-A07F-1DCFD06D3AEE}]    <C:\WINDOWS\system32\ddngfdgp.dll>
[{AD1EADE2-FFB7-491B-B232-CC8486C0DA39}]    <C:\WINDOWS\system32\AD1EADE2.dll>
[{386F663B-6277-4A28-A48C-9A0704B7BB99}]    <C:\WINDOWS\system32\jomfmmjb.dll>
[{E79679FA-1A07-4356-8AF2-4A74E5778198}]    <C:\WINDOWS\system32\enpmnpfa.dll>
[{B9E299F7-DA4F-44BD-87BA-B51BEC134A01}]    <C:\WINDOWS\system32\B9E299F7.dll>
[{136BA812-355B-471E-8D5A-D70977F452C0}]    <C:\WINDOWS\system32\136BA812.dll>
[{2FD6C804-CE5C-48B0-9BD8-CAC5508ADF2B}]    <C:\WINDOWS\system32\ifdmcogk.dll>
[{83E9FD38-F34A-47B6-BF9B-AA651DE28608}]    <C:\WINDOWS\system32\83E9FD38.dll>
[{C5ED317C-EA9A-4690-A711-7FE8C6FE9FCF}]    <C:\WINDOWS\system32\C5ED317C.dll>
[{7803FA25-4FAE-4111-AECE-750291FE7AA8}]    <C:\WINDOWS\system32\7803FA25.dll>
[{4C7C3D86-D93E-4EAB-A64C-41A9093AFD39}]    <C:\WINDOWS\system32\4C7C3D86.dll>
[{AF6C147B-960C-462C-ACF1-E687207D1D90}]    <C:\WINDOWS\system32\afmchknb.dll>
[{2625370F-94E1-41EB-85AB-D8D0AF584C97}]    <C:\WINDOWS\system32\2625370F.dll>
[{921164E3-947E-49A6-B314-00FF3E1EC8BD}]    <C:\WINDOWS\system32\pihhmkej.dll>
[{CA82FFB6-6152-451E-8D0B-81A7D5B83158}]    <C:\WINDOWS\system32\CA82FFB6.dll>
[{0B402387-DC1C-4FB5-8C56-9591CED94426}]    <C:\WINDOWS\system32\0B402387.dll>
[{17BFB15D-6645-4E17-A077-9CFCDB4BB497}]    <C:\WINDOWS\system32\17BFB15D.dll>
[{4E5B6F21-64B9-42DE-A875-B1FBA76AE645}]    <C:\WINDOWS\system32\4E5B6F21.dll>
[{E4CE11F7-F3E5-475E-B47B-BDB2E2EE6F80}]    <C:\WINDOWS\system32\E4CE11F7.dll>
[{D2FAC6AA-0E2B-411F-BDDF-04BF5775374B}]    <C:\WINDOWS\system32\D2FAC6AA.dll>
[{20D009ED-4DA0-41BC-A264-C5F1D01DCF21}]    <C:\WINDOWS\system32\20D009ED.dll>
[{F0870926-68E2-41E1-A10C-82B2C5B04950}]    <C:\WINDOWS\system32\F0870926.dll>
[{69D1993F-AA49-4176-86EC-AA174A99C4E0}]    <C:\WINDOWS\system32\69D1993F.dll>
[{C5C0BAC0-D9FB-420D-A6E4-AA5F08467FA6}]    <C:\WINDOWS\system32\C5C0BAC0.dll>
[{3F082D15-0869-4360-AB76-CCFBAE65BF9B}]    <C:\WINDOWS\system32\3F082D15.dll>
[{19FE4542-B801-46BD-8C7E-49DE5517A437}]    <C:\WINDOWS\system32\19FE4542.dll>
[{17788D2D-F348-42AF-8744-C9ACEC6100A0}]    <C:\WINDOWS\system32\17788D2D.dll>
[{4B341B15-4AF4-411A-8618-F011A7B72B62}]    <C:\WINDOWS\system32\4B341B15.dll>
[{F5F2C0BE-34F9-4C2D-9B47-38A7D99DFEB5}]    <C:\WINDOWS\system32\F5F2C0BE.dll>
[{CEAF3F5F-A552-43D0-8FDC-8CDA977222E1}]    <C:\WINDOWS\system32\CEAF3F5F.dll>
[{CEAF3F5F-A552-43D0-8FDC-8CDA977222E1}]    <C:\WINDOWS\system32\CEAF3F5F.dll>
[{B6A4D893-5D34-46C3-ADC3-195052E0D04C}]    <C:\WINDOWS\system32\B6A4D893.dll>
[{653477E7-9F06-4E2B-A609-44C52F35AAEE}]    <C:\WINDOWS\system32\653477E7.dll>
[{C2515274-BDBB-49E6-B021-078FDAEF9F2C}]    <C:\WINDOWS\system32\C2515274.dll>
[{3E1732F5-1BC1-4983-802D-4391C6085366}]    <C:\WINDOWS\system32\3E1732F5.dll>
[{068EA51C-B410-46AF-A055-DABDDA4D53CD}]    <C:\WINDOWS\system32\068EA51C.dll>
[{94732F54-E73E-4A5E-81A1-95B16DF05026}]    <C:\WINDOWS\system32\94732F54.dll>
[{16560263-938B-4919-991E-26346C1CC30B}]    <C:\WINDOWS\system32\16560263.dll>
[{3D2E07D3-2CFC-4A24-9079-7671A0C93E42}]    <C:\WINDOWS\system32\3D2E07D3.dll>
[{D6F730A5-2332-4B90-8A48-8FB595DBE867}]    <C:\WINDOWS\system32\D6F730A5.dll>
[{B72C31F3-6669-4B9E-8413-DEC23EBB99E8}]    <C:\WINDOWS\system32\B72C31F3.dll>
[{FCAC65F6-256F-490B-AD3F-2619B2ADE811}]    <C:\Program Files\Internet Explorer\SysNetNt.Sys>
[{A93061FE-464A-4E95-8E96-A54CD948B0F7}]    <C:\Program Files\Internet Explorer\Sys6NtMe.Zys>
[{E0D39066-96D7-4891-8527-488ADAFCD60F}]    <E0D39066.dll>
[{DA63E650-537C-4042-87BB-9D19D844680B}]    <DA63E650.dll>
[{E1384213-0948-4A60-A9E3-875B191CC2E7}]    <E1384213.dll>
[{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}]    <66AFCB56.dll>
[{2EF0D734-21FD-4225-A1A2-BCD296182AAF}]    <2EF0D734.dll>
[{BA7EDF54-8408-4B21-B351-7B447B344BA4}]    <BA7EDF54.dll>
[{9CA963CA-107C-4089-B0AB-31380F90D7E3}]    <9CA963CA.dll>
[{34A25F04-008D-403E-8EE6-2307BC02FA2E}]    <34A25F04.dll>
[{E4814792-EFA3-4C20-93D0-8B130A59F9A8}]    <E4814792.dll>
[{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}]    <08223B03.dll>
[{4FBFD5A4-5FE8-4444-8BD9-FD0FAFA64F96}]    <4FBFD5A4.dll>
[{133AEAC9-9C88-4905-864C-38BBA312D9B0}]    <133AEAC9.dll>
[{133AEAC9-9C88-4905-864C-38BBA312D9B0}]    <133AEAC9.dll>
[{DFB3DAC5-B0B5-4B05-BFCF-FB42737778FA}]    <DFB3DAC5.dll>
[{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}]    <122B901E.dll>
[{5934EA2B-B2C4-4BE7-BF7A-FBA781A12E40}]    <5934EA2B.dll>
[{56BC86C7-0692-4F94-A2C1-6CF1DBF8096C}]    <56BC86C7.dll>
[{C8FFD223-C0FB-40C5-94A0-FD7891AC18E9}]    <C8FFD223.dll>
[{E1D19FCC-4777-4D71-B863-6A0A5B4E59BC}]    <E1D19FCC.dll>
[{201476D0-2B18-462E-AB9F-3E2B0CC8732B}]    <201476D0.dll>
[{A1A6BC2E-C6A1-43C1-8884-A31D772F42B8}]    <A1A6BC2E.dll>
[nwiz]    <smxd011.exe>
[HBService32]    <System.exe>
[IFEO[CCenter.exe]]    <svchost.exe>
[IFEO[RavMon.exe]]    <svchost.exe>
[IFEO[RavMonD.exe]]    <svchost.exe>
[IFEO[RavStub.exe]]    <svchost.exe>
[IFEO[RavTask.exe]]    <svchost.exe>
[IFEO[rfwmain.exe]]    <svchost.exe>
[IFEO[rfwsrv.exe]]    <svchost.exe>
[IFEO[rfwstub.exe]]    <svchost.exe>
[IFEO[rfwsrv.exe]]    <svchost.exe>
[IFEO[rfwstub.exe]]    <svchost.exe>
[IFEO[rfwsrv.exe]]    <svchost.exe>
[IFEO[rfwstub.exe]]    <svchost.exe>
[IFEO[Thunder5.exe]]    <svchost.exe>
[IFEO[rfwstub.exe]]    <svchost.exe>
[IFEO[rfwsrv.exe]]    <svchost.exe>

注意该项[AppInit_DLLs]修改：把<kmon.dll,HBDNF.dll,HBJTLQ.dll,HBWD.dll,HBTL.dll,HBWOW.dll,HBJXSJ.dll,HBCHIBI.dll,HBQQSG.dll,HBmhly.dll,HBQQFFO.dll,HBXMJ.dll,HBLYFX.dll,HBZG.dll,B72C31F3.dll,D6F730A5.dll,3D2E07D3.dll,HBZHUXIAN.dll,16560263.dll,94732F54.dll,068EA51C.dll,3E1732F5.dll,C2515274.dll,HBASKTAO.dll,653477E7.dll,B6A4D893.dll,HBKDXY.dll,CEAF3F5F.dll,F5F2C0BE.dll,4B341B15.dll,17788D2D.dll,19FE4542.dll,3F082D15.dll,C5C0BAC0.dll,69D1993F.dll,F0870926.dll,20D009ED.dll,D2FAC6AA.dll,E4CE11F7.dll,4E5B6F21.dll,17BFB15D.dll,0B402387.dll,CA82FFB6.dll,pihhmkej.dll,2625370F.dll,afmchknb.dll,4C7C3D86.dll,7803FA25.dll,C5ED317C.dll,83E9FD38.dll,ifdmcogk.dll,136BA812.dll,B9E299F7.dll,enpmnpfa.dll,jomfmmjb.dll,AD1EADE2.dll,ddngfdgp.dll,9593F4D8.dll>修改为<>即清空

    启动项目 －－ 服务－－ 驱动程序之如下项删除：
(勾选隐藏已认证的微软项目,选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否NO"才是确认删除服务）


[HBKernel32 Driver / HBKernel32]    <\SystemRoot\system32\drivers\HBKernel32.sys>
[HBKernel32 Driver / HBKernel32]    <\SystemRoot\system32\drivers\HBKernel32.sys>
[f28907d / f28907d]    <\??\C:\WINDOWS\system32\f28907d.sys>
[f35ee9e / f35ee9e]    <\??\C:\WINDOWS\system32\f35ee9e.sys>
[d812a079 / d812a079]    <\??\C:\WINDOWS\system32\d812a079.sys>
[b1a18a3e / b1a18a3e]    <\??\C:\WINDOWS\system32\b1a18a3e.sys>
[b160485 / b160485]    <\??\C:\WINDOWS\system32\b160485.sys>
[aliimz / aliimz]    <System32\Drivers\aliimz.sys>
[6457aed / 6457aed]    <\??\C:\WINDOWS\system32\6457aed.sys>

    系统修复－－　浏览器加载项之如下项删除：
[]    <C:\Program Files\Internet Explorer\SysNetNt.Sys>
[]    <C:\Program Files\Internet Explorer\Sys6NtMe.Zys>
[]    <C:\Program Files\Internet Explorer\SysNetNt.Sys>
[]    <C:\Program Files\Internet Explorer\Sys6NtMe.Zys>