这里官网下载费尔木马强力清除助手,勾选“抑制文件再生”删除。
http://dl.filseclab.com/down/powerrmv.zip删除下面的所有文件：
g:\windows\system32\explorer.exe
g:\windows\system32\crugd.dll
g:\windows\system32\de54225f.dll
g:\windows\system32\ektvm.dll
g:\windows\system32\jyjlt.dll
g:\windows\system32\jzijj.dll
g:\windows\system32\lariytrz.dll
g:\windows\system32\rhs.dll
g:\docume~1\admini~1\locals~1\temp\k12070117843ow.dll
g:\program files\internet explorer\plugins\ns_sys55.sys
g:\windows\16186mm.dll
g:\windows\system32\avpsrv.dll
g:\windows\system32\csavpw0.dll
g:\windows\system32\csavpw1.dll
g:\windows\system32\dsqvgenh.dll
g:\windows\system32\fmsbbqi.dll
g:\windows\system32\kiluw.dll
g:\windows\system32\kvsc3.dll
g:\windows\system32\msepbe.dll
g:\windows\system32\msimms32.dll
g:\windows\system32\netsrv.dll
g:\windows\system32\rgfjj.dll
g:\windows\system32\upxdnd.dll
g:\windows\system32\wsockdrv32.dll
g:\windows\system32\xjxr.dll
g:\windows\avpsrv.exe
g:\windows\dxdlg.exe
g:\windows\system32\dxdlg.exe
g:\windows\system32\lyloadbr.exe
g:\windows\system32\lyleador.exe
g:\windows\system32\lyloador.exe
g:\windows\system32\lyloadar.exe
g:\windows\system32\lyloadmr.exe
g:\windows\system32\lyloadhr.exe
g:\windows\system32\lyloadqr.exe
g:\windows\wsockdrv32.exe
g:\windows\16186m.exe
g:\windows\upxdnd.exe
g:\windows\shaproc.exe
g:\windows\ptsshell.exe
g:\windows\nvdispdrv.exe
g:\windows\navmon32.exe
g:\windows\msimms32.exe
g:\windows\msccrt.exe
g:\windows\mppds.exe
g:\windows\lotushlp.exe
g:\windows\kvsc3.exe
g:\windows\zlvqfhwi.exe
g:\windows\fmsbbqi.exe
g:\windows\dbghlp32.exe
g:\windows\cmdbcs.exe
g:\windows\downlo~1\bdplugin.dll
g:\windows\avpsrv.exe
g:\windows\system32\852f0678.exe
g:\windows\system32\drivers\msosfpids32.sys
g:\windows\system32\drivers\pcisvc.sys
g:\docume~1\admini~1\locals~1\temp\tmpb.tmp
g:\windows\system32\drivers\phy.sys
g:\windows\system32\drivers\pabc.sys
g:\windows\system32\lqrmpovgyobjx.dll
C:\Autorun.inf
C:\auto.exe
D:\Autorun.inf
D:\auto.exe
E:\Autorun.inf
E:\auto.exe
G:\Autorun.inf
G:\auto.exe
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里面找下面项目删除：
[upxdnd] <G:\WINDOWS\upxdnd.exe>
[WinSysM] <G:\WINDOWS\16186M.exe>
[Kvsc3] <G:\WINDOWS\Kvsc3.exE>
[AVPSrv] <G:\WINDOWS\AVPSrv.exE>
[DXDLG32] <DXDLG.exe>
[MSDWG32] <LYLoadbr.exe>
[MSDCG32 ] <LYLeador.exe>
[MSDOG32] <LYLoador.exe>
[MSDSG32] <LYLoadar.exe>
[MSDMG32] <LYLoadmr.exe>
[MSDHG32] <LYLoadhr.exe>
[MSDQG32] <LYLoadqr.exe>
[{D29DCEE0-457B-45A2-A92D-741B95B7723B}] <G:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
[{8DFA2904-9664-43AE-8929-4347554D24B6}] <G:\WINDOWS\system32\csavpw0.dll>
[{0082AB9A-D7A2-456A-AE04-EB9ABF822FE4}] <G:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\k12070117843ow.dll>
[WSockDrv32] <; G:\WINDOWS\WSockDrv32.exe>
[WinSysM] <; G:\WINDOWS\16186M.exe>
[upxdnd] <; G:\WINDOWS\upxdnd.exe>
[SHAProc] <; G:\WINDOWS\SHAProc.exe>
[PTSShell] <; G:\WINDOWS\PTSShell.exe>
[NVDispDrv] <; G:\WINDOWS\NVDispDRV.EXE>
[NAVMon32] <; G:\WINDOWS\NAVMon32.exE>
[MsIMMs32] <; G:\WINDOWS\MsIMMs32.exE>
[msccrt] <; G:\WINDOWS\msccrt.exe>
[mppds] <; G:\WINDOWS\mppds.exe>
[LotusHlp] <; G:\WINDOWS\LotusHlp.exe>
[Kvsc3] <; G:\WINDOWS\Kvsc3.exE>
[gzslvvrq] <; G:\WINDOWS\zlvqfhwi.exe>
[fmsbbqi] <; G:\WINDOWS\fmsbbqi.exe>
[DbgHlp32] <; G:\WINDOWS\DbgHlp32.exe>
[cmdbcs] <; G:\WINDOWS\cmdbcs.exe>
[BIE] <; Rundll32 G:\WINDOWS\DOWNLO~1\BDPlugin.dll,Rundll32>
[AVPSrv] <; G:\WINDOWS\AVPSrv.exE>
[IFEO[pagefile.pif]] <AUTOGUARDER GUARDED.>
————————————————————————————————————
在扫日志的SRENG工具》启动项目》注册表》里将下面项目置空（就是选择“编辑”）这必须关闭杀毒软件的监控，否则改不了可能。
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,,msosmnsf00.dll> [N/A]
就是将[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><mrjhtjd.dll,qrhhb.dll,xdfntt.dll,hgfhk.dll,hjaiq.dll,kduy.dll,frntrn.dll,dnteh.dll,chmfcmh.dll,jwlah.dll,crugd.dll,lariytrz.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,ydgn.dll,dbfb.dll,fjnbv.dll,wmsat.dll,gmnait.dll,hfjg.dll,xdndn.dll,rgfjj.dll,dscef.dll,xfng.dll,njritc.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,fehom.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,rhs.dll,atehhz.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,hkfgh.dll,drghszd.dll,fngn.dll,xdhdg.dll,zdbfbd.dll,fjyjy.dll,,msosmnsf00.dll> [N/A] 的“值”项编辑置空为：
<AppInit_DLLs><> [N/A]
你只要输入任意一个字符，确定后就可以了。
——————————————————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》Win32服务应用程序》里面找下面项删除，或将启动类型改为“Disabled”
[6AB6A251 / 6AB6A251] <G:\WINDOWS\system32\852F0678.EXE -k>
————————————————————————————————————
在扫日志的SRENG工具》启动项目》服务》驱动程序》里面找下面项删除，或将启动类型改为“Disabled”
[fpids32 / fpids32] <\??\G:\WINDOWS\system32\drivers\msosfpids32.sys>
[iCafe Update / iCafe Update] <\??\G:\WINDOWS\system32\drivers\pcisvc.sys>
[mnsf / mnsf] <\??\G:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tmpB.tmp>
[phy / phy] <\??\G:\WINDOWS\system32\DRIVERS\phy.sys>
[puid / puid] <System32\DRIVERS\pabc.sys>
—————————————————————————————
在扫日志的SRENG工具》系统修复》浏览器加载项》里面找下面删除
[] <G:\WINDOWS\system32\lqrmpovgyobjx.dll>
[] <G:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
[] <G:\WINDOWS\system32\lqrmpovgyobjx.dll>
[] <G:\Program Files\Internet Explorer\PLUGINS\Ns_Sys55.Sys>
————————————————————————————————————
再重启电脑，升级杀毒软件至最新版本全盘杀毒。
下载卡卡助手，清理你那系统。
记得打打系统漏洞补丁
清空IE缓存，清空临时文件夹。
这 里 下 载 W i n d o w s 清 理 助 手 ，清理你那系统。
http://www.arswp.com/
