1建议使用XDelBox(下载地址：
http://bbs.ikaka.com/attachment.aspx?attachmentid=446806）
删除以下文件：（使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择剪贴板导入不检查路径，导入后记得勾选抑制其再生，在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储设备）
c:\windows\system32\anymie360.exe
C:\WINDOWS\system32\Drivers\msiffei.sys
C:\WINDOWS\system32\oceholnl.dll
C:\WINDOWS\system32\cjjjlfeo.dll
C:\WINDOWS\system32\dcefbehk.dll
C:\WINDOWS\system32\jkjoiiob.dll
C:\WINDOWS\system32\lcebimib.dll
C:\WINDOWS\system32\hkhmmmlh.dll
C:\WINDOWS\system32\nnlekbjl.dll
C:\WINDOWS\system32\hdbjlhhe.dll
C:\WINDOWS\system32\mpfdnkmp.dll
C:\WINDOWS\system32\clddegfc.dll
C:\WINDOWS\system32\bdiefkpg.dll
C:\WINDOWS\system32\ebglikim.dll
C:\WINDOWS\system32\hempemnm.dll
C:\WINDOWS\system32\cldkgdhh.dll
C:\WINDOWS\system32\anymie360.dll
2启动项目 －－ 注册表之如下项删除：
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<1A4ADC2D><C:\WINDOWS\system32\hakadcid.dll> [File is missing]
<90728BDC><C:\WINDOWS\system32\pgniobdc.dll> [File is missing]
<4F7D89E5><C:\WINDOWS\system32\kfndopel.dll> [File is missing]
<68E8F163><C:\WINDOWS\system32\moeofhmj.dll> [File is missing]
<2FBE10D6><C:\WINDOWS\system32\ifbehgdm.dll> [File is missing]
<D76F0455><C:\WINDOWS\system32\dnmfgkll.dll> [File is missing]
<189899FC><C:\WINDOWS\system32\hopoppfc.dll> [File is missing]
<C5DDE0FC><C:\WINDOWS\system32\clddegfc.dll> []
<69FD7469><C:\WINDOWS\system32\mpfdnkmp.dll> []
<BD2EF490><C:\WINDOWS\system32\bdiefkpg.dll> []
<EB052426><C:\WINDOWS\system32\ebglikim.dll> []
<1DB3511E><C:\WINDOWS\system32\hdbjlhhe.dll> []
<775E4B35><C:\WINDOWS\system32\nnlekbjl.dll> []
<DCEFBE14><C:\WINDOWS\system32\dcefbehk.dll> []
<5CEB262B><C:\WINDOWS\system32\lcebimib.dll> []
<3438228B><C:\WINDOWS\system32\jkjoiiob.dll> []
<C3335FE8><C:\WINDOWS\system32\cjjjlfeo.dll> []
<8CE18575><C:\WINDOWS\system32\oceholnl.dll> []
<14166651><C:\WINDOWS\system32\hkhmmmlh.dll> []
<1E69E676><C:\WINDOWS\system32\hempemnm.dll> []
<C5D40D11><C:\WINDOWS\system32\cldkgdhh.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{BE9DEA3A-893C-43F3-BC33-99574575A9F0}><C:\Program Files\Internet Explorer\PowerDn.Rel> [File is missing]
<{1A4ADC2D-DED4-4B91-B05D-3278CC009978}><C:\WINDOWS\system32\hakadcid.dll> [File is missing]
<{90728BDC-AC24-4608-8BF8-FCB1590BEDB8}><C:\WINDOWS\system32\pgniobdc.dll> [File is missing]
<{4F7D89E5-19E4-472F-B1DD-B33128E0C048}><C:\WINDOWS\system32\kfndopel.dll> [File is missing]
<{68E8F163-077E-47B6-8372-A06968A92BB2}><C:\WINDOWS\system32\moeofhmj.dll> [File is missing]
<{2FBE10D6-48C3-418F-8C62-5E5E42BC0A77}><C:\WINDOWS\system32\ifbehgdm.dll> [File is missing]
<{D76F0455-C4EE-40E1-8449-4B1C80AA5001}><C:\WINDOWS\system32\dnmfgkll.dll> [File is missing]
<{189899FC-C7C8-496E-8805-813DF03B5025}><C:\WINDOWS\system32\hopoppfc.dll> [File is missing]
<{C5DDE0FC-4E07-4307-96DC-A77EF2281BF5}><C:\WINDOWS\system32\clddegfc.dll> []
<{69FD7469-172E-4419-8150-04DF755F64A6}><C:\WINDOWS\system32\mpfdnkmp.dll> []
<{BD2EF490-CCC5-48C2-B606-DABEDC60A2FD}><C:\WINDOWS\system32\bdiefkpg.dll> []
<{EB052426-35A4-4922-A323-44B3EB93FBE8}><C:\WINDOWS\system32\ebglikim.dll> []
<{1DB3511E-C1BC-46D0-9A33-C315540FB0A4}><C:\WINDOWS\system32\hdbjlhhe.dll> []
<{775E4B35-351D-41B7-95C6-2BE4FB68477F}><C:\WINDOWS\system32\nnlekbjl.dll> []
<{DCEFBE14-1581-4F70-B594-6449D91A9D96}><C:\WINDOWS\system32\dcefbehk.dll> []
<{5CEB262B-18A3-47FD-B191-0E5C0F75B353}><C:\WINDOWS\system32\lcebimib.dll> []
<{3438228B-2995-4D13-9B7F-5F26FBBBEAD3}><C:\WINDOWS\system32\jkjoiiob.dll> []
<{C3335FE8-420C-43FD-B579-8531BCCF24AC}><C:\WINDOWS\system32\cjjjlfeo.dll> []
<{8CE18575-6637-44F8-9229-3523FA3D6823}><C:\WINDOWS\system32\oceholnl.dll> []
<{14166651-7DFD-48BA-87D6-9C903CDD5130}><C:\WINDOWS\system32\hkhmmmlh.dll> []
<{1E69E676-067A-432B-AE6A-173CE05C33DE}><C:\WINDOWS\system32\hempemnm.dll> []
<{C5D40D11-9E80-40E4-94A3-BEE322F8B29C}><C:\WINDOWS\system32\cldkgdhh.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe]
<IFEO[CCenter.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe]
<IFEO[RavMon.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe]
<IFEO[RavMonD.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe]
<IFEO[RavStub.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe]
<IFEO[RavTask.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe]
<IFEO[RfwMain.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe]
<IFEO[rfwsrv.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Thunder5.exe]
<IFEO[Thunder5.exe]><svchost.exe> [(Verified)Microsoft Windows Publisher]
3
C:\WINDOWS\system32\ctfmon.exe系统文件感染病毒。
开始——运行——dllcache
在里面找到对应的文件替换被感染的病毒文件。
4
修复劫持项。
http://bbs.ikaka.com/attachment.aspx?attachmentid=435625下载镜像劫持修复工具
