先传上来。。看看。。不确定是否被替换。。你不要杀这三个
c:\windows\system32\userinit.exe,
c:\windows\system\rund1132.exe,
c:\windows\system32\shell32.dll
建议使用XDelBox删除以下文件
复制所有要删除文件的路径,在待删除文件列表里点击右键选择从剪贴板导入,重启删除
c:\windows\system32\winfdphost.dll
c:\windows\system32\drivers\pnpmem.sys
c:\windows\system32\drivers\bdguard.sys
c:\windows\system32\drivers\acpidisk.sys
2.删除重启后使用SREng修复下面各项: 启动项目 -- 注册表之如下项删除:
[IFEO[360safe.exe]] <TASKMAN.EXE>
[IFEO[360safebox.exe]] <TASKMAN.EXE>
[IFEO[360safeup.exe]] <TASKMAN.EXE>
[IFEO[360tray.exe]] <TASKMAN.EXE>
[IFEO[avp.exe]] <TASKMAN.EXE>
[IFEO[CCenter.exe]] <TASKMAN.EXE>
[IFEO[egui.exe]] <TASKMAN.EXE>
[IFEO[ekrn.exe]] <TASKMAN.EXE>
[IFEO[esslibupdate.exe]] <TASKMAN.EXE>
[IFEO[extdb.exe]] <TASKMAN.EXE>
[IFEO[nod32krn.exe]] <TASKMAN.EXE>
[IFEO[nod32kui.exe]] <TASKMAN.EXE>
[IFEO[ras.exe]] <TASKMAN.EXE>
[IFEO[Rav.exe]] <TASKMAN.EXE>
[IFEO[RavMon.exe]] <TASKMAN.EXE>
[IFEO[RavMonD.exe]] <TASKMAN.EXE>
[IFEO[RavStub.exe]] <TASKMAN.EXE>
[IFEO[RavTask.exe]] <TASKMAN.EXE>
[IFEO[rfwcfg.exe]] <TASKMAN.EXE>
[IFEO[rfwmain.exe]] <TASKMAN.EXE>
[IFEO[rfwProxy.exe]] <TASKMAN.EXE>
[IFEO[rfwsrv.exe]] <TASKMAN.EXE>
[IFEO[rfwstub.exe]] <TASKMAN.EXE>
[IFEO[Rsaupd.exe]] <TASKMAN.EXE>
[IFEO[RsMain.exe]] <TASKMAN.EXE>
[IFEO[rsnetsvr.exe]] <TASKMAN.EXE>
[IFEO[RSTray.exe]] <TASKMAN.EXE>
[IFEO[runiep.exe]] <TASKMAN.EXE>
[IFEO[safebank.exe]] <TASKMAN.EXE>
[IFEO[safeboxTray.exe]] <TASKMAN.EXE>
[IFEO[safeboxup.exe]] <TASKMAN.EXE>
[IFEO[ScanFrm.exe]] <TASKMAN.EXE>
[IFEO[SmartUp.exe]] <TASKMAN.EXE>
[IFEO[UpFile.exe]] <TASKMAN.EXE>
注意该项[Userinit]修改:把<C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system\rund1132.exe,>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略
[PostBootReminder] <%SystemRoot%\system32\SHELL32.dll>
启动项目 -- 服务 -- Win32服务应用程序之如下项禁用:
[Windows Function Discovery Provider Host / WinfdPHost] <C:\WINDOWS\System32\svchost.exe -k WinfdPHost-->c:\windows\system32\winfdphost.dll>
启动项目 -- 服务-- 驱动程序之如下项禁用:
[pnpmem / pnpmem] <\??\C:\WINDOWS\system32\drivers\pnpmem.sys>
[BdGuard / BdGuard] <\SystemRoot\system32\drivers\BDGuard.SYS>
[acpidisk / acpidisk] <\??\C:\WINDOWS\system32\drivers\acpidisk.sys>
**************以上分析报告由SREngLog分析助手提供******************分析:whzl123
时间:2009-2-18
SREngLog分析助手 1.3 (20071108 更新 BY 草莽书生)