原帖由 跑野的驼羔 于 2009-5-12 20:40:00 发表
朋友的机器装有瑞星09版全功能杀毒软件。但现在瑞星不能够正常启动。清理助手杀毒重启病毒还是回来了。注册表打不开，搜索功能不能用，隐藏属性不能显示，用工具修复后可以看到C盘下有病毒文件，但删除后病毒文件还会回来之前修复的项目也是照旧。而且用冰刃工具删除HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File
1、红色的－－文件还在，黑色的－－－文件已经删除：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{E11FB24A-F766-4D0F-ADF5-237958FFA262}><C:\WINDOWS\fonts\f13ERxR2Urh.fon> []
<{3BF06F2A-7AA8-4474-90A2-CFAFC22D43AB}><C:\WINDOWS\fonts\cC8kqzNExNc.fon> [] <{6B74576A-BB20-47B3-AE0A-046B062897D0}><C:\WINDOWS\system32\ACg9ycsarj8y.dll> [File is missing]
<{70DF1AE4-AF9E-4457-8A6A-D2D49691FF4B}><C:\Program Files\Internet Explorer\DoboMako.lsp> [File is missing]
<{EA25F4E7-8B67-452A-B9DD-B38C526250D3}><C:\WINDOWS\fonts\Q9UnbAWWNuSv4.fon> [] <{1ECE2FCB-C1BB-4706-920C-F4C1076FD155}><C:\WINDOWS\system32\kT2NuqZeGma.dll> [File is missing]
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> [File is missing]
<{E88AE11C-26DF-4F4D-8726-C043F513990E}><C:\WINDOWS\system32\yp77Tt3UCG74J.dll> [File is missing]
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> [File is missing]
<{737858A9-9AEA-4838-9B49-54DA731F7F37}><C:\WINDOWS\system32\BMsg6pdMD4ht.dll> [File is missing]
<{4E5CFE74-700B-4A8B-B0BF-A6B47D896C18}><C:\WINDOWS\system32\GrTZqH5SnRhAt.dll> [File is missing]
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> [File is missing]
<{0D267113-499A-4EEF-998D-C45731C1B313}><C:\WINDOWS\system32\VnTU2WAqUcZA6.dll> [File is missing]
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> [File is missing]
<{CCCA2FB9-2D5D-4481-8BFE-1CDDC458A3F4}><C:\WINDOWS\system32\CCCA2FB9.dll> [File is missing]
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> [File is missing]
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> [File is missing]
<{7A93621D-BFFE-4EB1-AAE1-CD487F429840}><C:\WINDOWS\system32\PkVyCX5kHnftC7BXjt.dll> [File is missing]
<{171565E3-F0BB-4FF0-9A42-C9406C79DB78}><C:\WINDOWS\system32\wF87W8XjgDW5Es6tuA.dll> [File is missing]
<{C722AD57-35DA-4460-8353-328372F32AB2}><C:\WINDOWS\system32\ufQCU5.dll> [File is missing]
<{A35BF249-2B40-4E4A-97B5-86DC8B358887}><C:\WINDOWS\system32\j8EG7scz8.dll> [File is missing]
<{2EF0D734-21FD-4225-A1A2-BCD296182AAF}><C:\WINDOWS\system32\2EF0D734.dll> [File is missing]
2、IEFEO从这开始：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe]
<IFEO[360hotfix.exe]><ntsd -d> [N/A]
到这为止：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xnlscn.exe]
<IFEO[xnlscn.exe]><ntsd -d> [N/A]
全部删除。。
3、删除下面的服务项：
[kagnenqucbf / kagnenqucbf][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k krnlsrvc-->C:\WINDOWS\system32\RfmqttC.dll><@ Microsoft Corporation. All rights reserved.>
[Task Scheduler / Schedule][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->%SystemRoot%\system32\schedsvc.dll><N/A>
[COM+ Windows System Server / WinSCCOM][Running/Auto Start]
<C:\WINDOWS\winsccoo.exe><Microsoft Corporation>
4、删除下面的驱动项：
[Ch000001 / Ch000001][Stopped/Manual Start]
<\??\C:\DOCUME~1\Owner\LOCALS~1\Temp\Rar$EX00.609\Ch000001.sys><N/A>
[Network Monitor Protocol Driver / MyProt][Running/Manual Start]
<system32\DRIVERS\winyyy.sys><Windows (R) 2000 DDK provider>
[NsDlRK250 / NsDlRK250][Running/Manual Start]
<\??\C:\WINDOWS\system32\Nskhelper2.sys><N/A>
[zx / zx][Stopped/Manual Start]
<\??\C:\WINDOWS\TEMP\~10c65.tmp><N/A>
[RESSDT / RESSDT][Stopped/Manual Start]
<\??\c:\x1.tmp><N/A>
[NsPsDk01 / NsPsDk01][Running/Manual Start]
<\??\C:\WINDOWS\system32\NsPass1.sys><N/A>
[NsPsDk02 / NsPsDk02][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\NsPass2.sys><N/A>
[NsPsDk03 / NsPsDk03][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\NsPass3.sys><N/A>
[NsPsDk04 / NsPsDk04][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\NsPass4.sys><N/A>
5、删除浏览器加载项：
[]
{09EB15FA-17D8-4D60-8598-3F549A848DF2} <C:\PROGRA~1\INTERN~1\PLUGINS\b54321.bho, N/A>
[]
{70DF1AE4-AF9E-4457-8A6A-D2D49691FF4B} <C:\Program Files\Internet Explorer\DoboMako.lsp, N/A>
6、用XDELBOX删除上述注册表项指向的程序以及下面的程序：
[C:\WINDOWS\system32\COMRes.dll] [N/A, ]
[C:\WINDOWS\fonts\cC8kqzNExNc.fon] [N/A, ]
[C:\WINDOWS\fonts\f13ERxR2Urh.fon] [N/A, ]
[C:\WINDOWS\fonts\GTH63399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH64399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH67399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH69399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH72390.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH73399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH75399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH80399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH83399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH88399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH92399.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH93380.ttf] [N/A, ]
[C:\WINDOWS\fonts\GTH97386.ttf] [N/A, ]
