以下操作有风险，仅供参考：
1.使用XDelBox删除以下文件
c:\windows\system32\1270000.dll
c:\docume~1\colorful\locals~1\temp\dat22.tmp
c:\docume~1\colorful\locals~1\temp\dat26.tmp
c:\program files\internet explorer\plugins\ns_sys55.sys
c:\windows\system32\idbkjn.dll
c:\windows\system32\iqahwdjwd.dll
c:\windows\system32\lotushlp.dll
c:\windows\system32\pedadt.dll
c:\windows\system32\ptsshell.dll
c:\windows\system32\wsockdrv32.dll
c:\windows\system32\pvclwdjzx.dll
c:\windows\system32\cmdbcs.dll
c:\windows\system32\d3d9_32.dll
c:\windows\system32\dbghlp32.dll
c:\windows\system32\dscef.dll
c:\windows\system32\eohsom.dll
c:\windows\system32\fifeei.dll
c:\windows\system32\gjkhj.dll
c:\windows\system32\gnolnait.dll
c:\windows\system32\ijougiemnaw.dll
c:\windows\system32\jlxbxbzc.dll
c:\windows\system32\kvsc3.dll
c:\windows\system32\mnauygniqaixnaij.dll
c:\windows\system32\msccrt.dll
c:\windows\system32\msosiocp.dll
c:\windows\system32\nufarm.dll
c:\windows\system32\pahzij.dll
c:\windows\system32\setup\en_1072.bin
c:\windows\system32\taijoad.dll
c:\windows\system32\tsqc.dll
c:\windows\system32\upxdnd.dll
c:\windows\system32\xbcvxb.dll
c:\windows\system32\xfgnxfn.dll
c:\windows\system32\msosdrop00.dll
mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,,msosmhfp00.dll,msosdrop00.dll,msosdohs00.dll
lyloadqr.exe
lyloadhr.exe
lyloadmr.exe
lyloadar.exe
lyloador.exe
lyleador.exe
lyloadbr.exe
c:\windows\winsvr32.exe
c:\windows\shaproc.exe
c:\docume~1\colorful\locals~1\temp\dat26.tmp"
c:\windows\system32\7942a800.exe
c:\docume~1\colorful\locals~1\temp\tmp1c.tmp
c:\docume~1\colorful\locals~1\temp\tmp2f.tmp
c:\windows\system32\drivers\msosfpids32.sys
e:\program files\qq\npkycryp.sys
c:\windows\system32\new.sys
2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[{D29DCEE0-457B-45A2-A92D-741B95B7723B}] <C:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
[{5E907A48-400E-4EA8-9792-FFAE052D59E9}] <C:\WINDOWS\system32\pedadt.dll>
[{50632D5C-B71B-4ba0-B012-3DC6F15C011B}] <C:\WINDOWS\system32\msosiocp.dll>
[{7FA4A83B-F99A-4bfc-A8E2-6A62B05D2C82}] <C:\DOCUME~1\colorful\LOCALS~1\Temp\dat26.tmp>
注意该项[AppInit_DLLs]修改：把<mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,,msosmhfp00.dll,msosdrop00.dll,msosdohs00.dll>修改为<>即清空
[MSDQG32] <LYLoadqr.exe>
[MSDHG32] <LYLoadhr.exe>
[MSDMG32] <LYLoadmr.exe>
[MSDSG32] <LYLoadar.exe>
[MSDOG32] <LYLoador.exe>
[MSDCG32 ] <LYLeador.exe>
[MSDWG32] <LYLoadbr.exe>
[WINSvr32] <C:\WINDOWS\WINSvr32.exE>
[SHAProc] <C:\WINDOWS\SHAProc.exe>
[WinShell] <"C:\WINDOWS\system32\Rundll32.exe" "C:\WINDOWS\system32\shell32.dll",Control_RunDLL "C:\DOCUME~1\colorful\LOCALS~1\Temp\dat26.tmp">
启动项目 －－ 服务 －－ Win32服务应用程序之如下项删除：
[D95EF600 / D95EF600] <C:\WINDOWS\system32\7942A800.EXE -d>
启动项目 －－ 服务－－ 驱动程序之如下项删除：
[dohs / dohs] <\??\C:\DOCUME~1\colorful\LOCALS~1\Temp\tmp1C.tmp>
[drop / drop] <\??\C:\DOCUME~1\colorful\LOCALS~1\Temp\tmp2F.tmp>
[fpids32 / fpids32] <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
[oreans32 / oreans32] <\??\C:\WINDOWS\system32\drivers\oreans32.sys>
[npkycryp / npkycryp] <\??\E:\Program Files\QQ\npkycryp.sys>
[New0 / New0] <\??\C:\WINDOWS\system32\new.sys>
[kmsinput / kmsinput] <\??\C:\WINDOWS\system32\drivers\kmsinput.sys>
[dtscsi / dtscsi] <\SystemRoot\System32\Drivers\dtscsi.sys>
系统修复－－ 浏览器加载项之如下项删除：
[] <C:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
[] <C:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
4.建议复查以下文件：
c:\windows\system32\drivers\oreans32.sys
c:\windows\system32\drivers\kmsinput.sys
c:\windows\system32\drivers\dtscsi.sys
