SRENG- 启动项目 -- 注册表之如下项删除:
[WINSvr32] <C:\WINDOWS\WINSvr32.exE>
[NAVMon32] <C:\WINDOWS\NAVMon32.exE>
[SHAProc] <C:\WINDOWS\SHAProc.exe>
[WinSysW] <C:\WINDOWS\235780L.exe>
[RegSrv64D] <C:\WINDOWS\RegSrv64D.exE>
[{021F087F-4378-545F-74FA-37D345AD7A8C}] <C:\WINDOWS\System32\mjgfth.dll>
[{C0595A7E-2E2F-4B34-A83A-019270A0A464}] <C:\WINDOWS\System32\tdffdl.dll>
[{8C41B7F7-3168-400D-A702-0E7EFE0BA304}] <C:\WINDOWS\System32\sgdewg.dll>
[{28EB3777-3E23-4E72-8449-A992D09D24C3}] <C:\WINDOWS\System32\zefdst.dll>
[{461D2AB4-29A5-45C2-9134-D52272D3DE38}] <C:\WINDOWS\System32\rfdswc.dll>
[{45AADFAA-DD36-42AB-83AD-0521BBF58C24}] <C:\WINDOWS\System32\zggxrx.dll>
[{53D44DB6-E22B-4B17-97D3-572C96CCA6E1}] <C:\WINDOWS\System32\zsdgff.dll>
[{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}] <C:\WINDOWS\System32\hhrdxd.dll>
[{84143967-B645-4BFF-B873-DA1DC886E9A7}] <C:\WINDOWS\System32\cedafb.dll>
[{841529CB-7F77-4B99-A895-B5441E0D302F}] <C:\WINDOWS\System32\jfrwdh.dll>
[{0B846B26-BFE6-4E8E-A948-1DB17B77B483}] <C:\WINDOWS\System32\tdfhex.dll>
[{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}] <C:\WINDOWS\System32\fsrgeb.dll>
[{B29583D8-033A-4B9F-8553-7C5458F3FB8E}] <C:\WINDOWS\System32\jdsaex.dll>
[{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}] <C:\WINDOWS\System32\tdggrz.dll>
[{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}] <C:\WINDOWS\System32\wklsdd.dll>
[{73AE86E6-7F03-4C3B-8980-FB1DA157D3C7}] <C:\WINDOWS\System32\fmcvxy.dll>
[{5E907A48-400E-4EA8-9792-FFAE052D59E9}] <C:\WINDOWS\System32\pedadt.dll>
[{3A698452-C5D8-C584-C256-C264C987C5A3}] <C:\WINDOWS\Fonts\ijdycpaw.dll>
[{C629FF4F-ACDB-5C90-A098-FACB3456A26C}] <C:\WINDOWS\Fonts\lopdfeab.dll>
[{9FD45A54-9875-698F-E56E-65102358FDF9}] <C:\WINDOWS\Fonts\apsghjba.dll>
[{F490415F-65F8-B5C5-D8BA-9405FB12054F}] <C:\WINDOWS\system32\jlgejgei32fg.dll>
[{A0AF1289-F140-A140-D012-C1458759FC0A}] <C:\WINDOWS\Fonts\ypcqihlp.dll>
[{8C648541-1025-9650-9057-6541258720C8}] <C:\WINDOWS\Fonts\mndhhdwd.dll>
注意该项[AppInit_DLLs]修改:把<zefdst.dll,nvipat.dll,lensch.dll,wdhotem.dll,jlgejgei32fg.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,kmon.dll>修改为<C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,kmon.dll>
启动项目 -- 服务-- 驱动程序之如下项删除:
(选中有问题的驱动/服务后,点"删除服务",点"设置"按钮即可。注意弹出的窗口中要点"否NO"才是确认删除服务)
[New0 / New0] <\??\C:\WINDOWS\System32\new.sys>
附件清除映像劫持项