C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\rpcss.dll
从正常的系统文件找到
替换本机文件
金山清理专家
在线系统诊断
隐藏安全项后
修复：
===========================================================
执行挂钩
==============================================================
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{CABA599D-5089-4865-9420-E41FA3C1F55F}> <CABA599D.dll>
文件路径: C:\WINDOWS\system32\CABA599D.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{3D144530-43DA-47CC-B7C7-A3A9F3B9A6B2}> <3D144530.dll>
文件路径: C:\WINDOWS\system32\3D144530.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{DE02F764-C51A-4788-9597-D78ECC2AC08F}> <DE02F764.dll>
文件路径: C:\WINDOWS\system32\DE02F764.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{43ACDCC5-9009-4AF4-B80A-93BC656EF298}> <43ACDCC5.dll>
文件路径: C:\WINDOWS\system32\43ACDCC5.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{E3367679-4775-4244-A62E-4CFE58FC850B}> <E3367679.dll>
文件路径: C:\WINDOWS\system32\E3367679.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{D7C79813-9233-4AE0-832C-99B2E8019673}> <D7C79813.dll>
文件路径: C:\WINDOWS\system32\D7C79813.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}> <122B901E.dll>
文件路径: C:\WINDOWS\system32\122B901E.dll [分析中]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{12B02216-AC3F-42A7-8313-449771237061}> <12B02216.dll>
文件路径: C:\WINDOWS\system32\12B02216.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}> <E4814792.dll>
文件路径: C:\WINDOWS\system32\E4814792.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{9F684DE8-3E87-4174-9033-E02A3DFD8B61}> <9F684DE8.dll>
文件路径: C:\WINDOWS\system32\9F684DE8.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{22D75360-199D-4F79-880D-82E766675F06}> <22D75360.dll>
文件路径: C:\WINDOWS\system32\22D75360.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{4BF9CBA3-8DEE-41A1-8BDB-FC28D30E949F}> <4BF9CBA3.dll>
文件路径: C:\WINDOWS\system32\4BF9CBA3.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{3474A8C2-BEF9-46C8-983A-A26A0030EC30}> <3474A8C2.dll>
文件路径: C:\WINDOWS\system32\3474A8C2.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{DA63E650-537C-4042-87BB-9D19D844680B}> <DA63E650.dll>
文件路径: C:\WINDOWS\system32\DA63E650.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{B3721C07-62B3-411A-9DC7-F5F27E3E21FF}> <B3721C07.dll>
文件路径: C:\WINDOWS\system32\B3721C07.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{58FF3024-8A83-4B1A-88E9-302F47646EEE}> <58FF3024.dll>
文件路径: C:\WINDOWS\system32\58FF3024.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{8566F82E-03A4-416E-AEAC-66600D8881F1}> <8566F82E.dll>
文件路径: C:\WINDOWS\system32\8566F82E.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{495271CA-D0C6-4052-ABE6-5B01C73CDFB0}> <495271CA.dll>
文件路径: C:\WINDOWS\system32\495271CA.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}> <08223B03.dll>
文件路径: C:\WINDOWS\system32\08223B03.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{9CA963CA-107C-4089-B0AB-31380F90D7E3}> <9CA963CA.dll>
文件路径: C:\WINDOWS\system32\9CA963CA.dll [病毒程序]
--------------------------------------------------------------
该项来源: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
<{E0D39066-96D7-4891-8527-488ADAFCD60F}> <E0D39066.dll>
文件路径: C:\WINDOWS\system32\E0D39066.dll [分析中]
f附件解压后运行(
勾选抑制再生）粉碎文件：
C:\WINDOWS\system32\3D144530.dll
C:\WINDOWS\system32\DE02F764.dll
C:\WINDOWS\system32\43ACDCC5.dll
C:\WINDOWS\system32\E3367679.dll
C:\WINDOWS\system32\D7C79813.dll
C:\WINDOWS\system32\122B901E.dll
C:\WINDOWS\system32\12B02216.dll
c:\WINDOWS\system32\E4814792.dll
C:\WINDOWS\system32\9F684DE8.dll
C:\WINDOWS\system32\22D75360.dll
C:\WINDOWS\system32\4BF9CBA3.dll
C:\WINDOWS\system32\3474A8C2.dll
C:\WINDOWS\system32\DA63E650.dll
C:\WINDOWS\system32\B3721C07.dll
C:\WINDOWS\system32\58FF3024.dll
C:\WINDOWS\system32\8566F82E.dll
C:\WINDOWS\system32\495271CA.dll
C:\WINDOWS\system32\08223B03.dll
C:\WINDOWS\system32\9CA963CA.dll
C:\WINDOWS\system32\E0D39066.dll
F:\auto.exe
D:\auto.exe
E:\auto.exe
E:\autorun.inf
D:\autorun.inf
F:\autorun.inf
