先下载XDelbox1.5删除工具: http://bbs.duba.net/attachment.php?aid=16039019
打开XDelbox1.5把以下路径添加进去,然后点右键,立即重启并删除.
C:\WINDOWS\WinRaR.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\AVPSrv.exe
C:\WINDOWS\NVDispDrv.exe
C:\Program Files\NetMeeting\ravmhmon.exe
C:\Program Files\NetMeeting\ravmsmon.exe
C:\Program Files\NetMeeting\ravwlmon.exe
C:\Program Files\NetMeeting\ravztmon.exe
C:\Program Files\NetMeeting\ravzxmon.exe
C:\WINDOWS\LYLoader.exe
C:\WINDOWS\LYLoadbr.exe
C:\WINDOWS\LYLeador.exe
C:\WINDOWS\LYLoador.exe
C:\WINDOWS\LYLoadar.exe
C:\WINDOWS\LYLoadmr.exe
C:\WINDOWS\LYLoadhr.exe
C:\WINDOWS\LYLoadqr.exe
C:\Program Files\Internet Explorer\rksldk.dll
C:\WINDOWS\system32\wodoor0.dll
C:\WINDOWS\system32\ztdoor0.dll
C:\WINDOWS\system32\jtdoor0.dll
C:\WINDOWS\system32\dadoor0.dll
C:\WINDOWS\system32\qhdoor0.dll
C:\WINDOWS\system32\mydoor0.dll
C:\WINDOWS\system32\zxdoor0.dll
C:\WINDOWS\system32\tldoor0.dll
C:\WINDOWS\system32\wddoor0.dll
C:\WINDOWS\system32\rxdoor0.dll
C:\WINDOWS\system32\qjdoor0.dll
C:\WINDOWS\system32\wgdoor0.dll
C:\WINDOWS\system32\wldoor0.dll
C:\WINDOWS\system32\myhpri.dll
C:\WINDOWS\system32\kvdxbma.dll
C:\WINDOWS\system32\kawdbzy.dll
C:\WINDOWS\system32\zxipri.dll
C:\WINDOWS\system32\raqjapi.dll
C:\WINDOWS\system32\rsjzapm.dll
C:\WINDOWS\system32\kapjazy.dll
C:\WINDOWS\system32\kaqhczy.dll
C:\WINDOWS\system32\mhdoor1.dll
C:\Program Files\Internet Explorer\OnlO0r.dll
C:\WINDOWS\system32\rarjapi.dll
C:\WINDOWS\system32\rsmyapm.dll
E:\Autorun.inf
E:\AutoRun.exe
等清除完重启计算机时按F8进入安全模式:
打开sreng
启动项目--注册表--双击<AppInit_DLLs>清空<rsmyapm.dll>
删除如下项目:
<w><%SystemRoot%\WinRaR.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<AVPSrv><C:\WINDOWS\AVPSrv.exe> []
<NVDispDrv><C:\WINDOWS\NVDispDrv.exe> []
<ravmhmon><C:\Program Files\NetMeeting\ravmhmon.exe> []
<ravmsmon><C:\Program Files\NetMeeting\ravmsmon.exe> []
<ravwlmon><C:\Program Files\NetMeeting\ravwlmon.exe> []
<ravztmon><C:\Program Files\NetMeeting\ravztmon.exe> []
<ravzxmon><C:\Program Files\NetMeeting\ravzxmon.exe> []
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
<{DC7596CB-D6CC-DCA3-DE52-DEEA63F6C61D}><C:\Program Files\Internet Explorer\rksldk.dll> [N/A]
<{5731EA1D-6AAF-4DE9-BDDA-7B390A75B286}><C:\WINDOWS\system32\wodoor0.dll> [N/A]
<{E952B8F8-D91A-4EDD-851C-EE1A0F944469}><C:\WINDOWS\system32\ztdoor0.dll> [N/A]
<{71046DD5-E136-4C4B-A6B5-91C30CB15291}><C:\WINDOWS\system32\jtdoor0.dll> [N/A]
<{D8CC4845-441C-44F8-9053-28F2EF67655B}><C:\WINDOWS\system32\dadoor0.dll> [N/A]
<{ABD0935D-B35A-47BD-BA9A-81678DDE74DD}><C:\WINDOWS\system32\qhdoor0.dll> []
<{4E3FBFA4-F1CC-4B66-B333-B9F0FF4B4748}><C:\WINDOWS\system32\mydoor0.dll> [N/A]
<{781FBCC1-99C7-4AE0-95F7-66EA49E86DD7}><C:\WINDOWS\system32\zxdoor0.dll> [N/A]
<{08E909A4-B236-48DD-8BCC-90A604B93E68}><C:\WINDOWS\system32\tldoor0.dll> [N/A]
<{68F7767A-090C-4BBF-A015-720ACC6706E2}><C:\WINDOWS\system32\wddoor0.dll> [N/A]
<{EDFF29C1-5A70-4460-AC1D-16DCB4B672F0}><C:\WINDOWS\system32\rxdoor0.dll> []
<{6826A3DB-EA8E-4E67-880D-53D04C7C0BD8}><C:\WINDOWS\system32\qjdoor0.dll> [N/A]
<{A3C95A74-638D-4C6B-A856-4B27664A7F47}><C:\WINDOWS\system32\wgdoor0.dll> [N/A]
<{E03C23BD-35B7-49C2-BBCA-6D8CEC2507E3}><C:\WINDOWS\system32\wldoor0.dll> [N/A]
<{8562452F-FA36-BA4F-892A-FF5FBBAC5318}><C:\WINDOWS\system32\myhpri.dll> [N/A]
<{2C87A354-ABC3-DEDE-FF33-3213FD7447C2}><C:\WINDOWS\system32\kvdxbma.dll> []
<{28907901-1416-3389-9981-372178569982}><C:\WINDOWS\system32\kawdbzy.dll> []
<{9A65498A-7653-9801-1647-987114AB7F49}><C:\WINDOWS\system32\zxipri.dll> []
<{14783410-4F90-34A0-7820-3230ACD05F41}><C:\WINDOWS\system32\raqjapi.dll> []
<{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\system32\rsjzapm.dll> []
<{1A321487-4977-D98A-C8D5-6488257545A1}><C:\WINDOWS\system32\kapjazy.dll> []
<{37D81718-1314-5200-2597-587901018073}><C:\WINDOWS\system32\kaqhczy.dll> []
<{3422FB0F-95EB-458A-8B56-39552017A4EF}><C:\WINDOWS\system32\mhdoor1.dll> []
<{CC3596CB-D6C1-ECA1-AE51-DEEA63F6C21C}><C:\Program Files\Internet Explorer\OnlO0r.dll> [N/A]
<{1598FF45-DA60-F48A-BC43-10AC47853D51}><C:\WINDOWS\system32\rarjapi.dll> []
<{1E32FA58-3453-FA2D-BC49-F340348ACCE1}><C:\WINDOWS\system32\rsmyapm.dll> []
<{14783410-4F><> [N/A]
点击系统修复--Winsock 提供者--重置所有内容为默认值.
如果还有问题再发个扫描报告上来.
