下载附件 解压后将注册表导入点击下载雨林木风PE安装包进行安装以防止误操作删除系统文件无法进入系统时的修复,并在安装完成后重起一次确认可以正常进入PE系统后继续以下操作。http://bbs.ikaka.com/showtopic-8502100.aspx参考这里下载PE、“费尔……助手”、大蜘蛛后安装PE重起进入PE删除以下文件，并复制c:\windows\system32\dllcache\explorer.exe粘贴到c:\windows\，复制c:\windows\system32\dllcache\userinit.exe粘贴到c:\windows\system32\
c:\windows\system32\bjrvm.dll
c:\windows\system32\ektvm.dll
c:\windows\system32\fdght.dll
c:\windows\system32\frntrn.dll
c:\windows\system32\lariytrz.dll
c:\windows\system32\oqrthc.dll
c:\windows\system32\xdndn.dll
c:\docume~1\admini~1\locals~1\temp\vgod.dll
c:\windows\downlo~1\cnsmin.dll
c:\windows\system32\d3d9_32.dll
c:\windows\system32\dbhlp32.dll
c:\windows\system32\fiosectc.dll
c:\windows\system32\fmsbbqi.dll
c:\windows\system32\fmsjhif.dll
c:\windows\system32\oohxbbyt.dll
c:\windows\system32\sperls.dll
c:\windows\system32\ticisms.dll
c:\windows\system32\explorer.exe
c:\progra~1\3721\alliveex.dll
c:\progra~1\3721\alrex.dll
c:\progra~1\3721\autolive.dll
c:\progra~1\3721\helper.dll
c:\windows\downlo~1\cnshook.dll
c:\windows\downlo~1\cnsio.dll
c:\windows\downlo~1\cnsminio.dll
c:\windows\system32\dqqacqac1041.dll
c:\windows\system32\dqsadsad1040.dll
c:\windows\system32\ttdxydxy1014.dll
c:\windows\system32\tthadhad1071.dll
c:\windows\system32\ttkafkaf1074.dll
c:\windows\system32\ttmysmys1053.dll
c:\windows\system32\ttshyshy1056.dll
c:\windows\downlo~1\cnsminex.dll
c:\progra~1\3721\notifier.dll
c:\windows\downlo~1\cnshint.dll
c:\windows\downlo~1\cnsplus.dll
c:\program files\internet explorer\plugins\nt_sys32.sys
c:\windows\system32\dqhadhad1066.dll
c:\windows\system32\lyloadqr.exe
c:\windows\system32\lyloadhr.exe
c:\windows\system32\lyloadmr.exe
c:\windows\system32\lyloadar.exe
c:\windows\system32\drivers\obj2.sys
c:\windows\\systemroot\system32\drivers\ndliphrb.sys
c:\windows\system32\drivers\msosmsfpfis64.sys
c:\docume~1\admini~1\locals~1\temp\tmp1c.tmp
c:\docume~1\admini~1\locals~1\temp\tmp1a.tmp
c:\windows\system32\drivers\cnsminkp.sys
C:\WINDOWS\system32\ttSHYSHY1056.dll
C:\WINDOWS\system32\dqSADSAD1040.dll
C:\WINDOWS\system32\dqHADHAD1066.dll
C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys
C:\WINDOWS\system32\ttKAFKAF1074.dll
C:\WINDOWS\system32\ttDXYDXY1014.dll
C:\WINDOWS\system32\ttMYSMYS1053.dll
C:\WINDOWS\system32\oohxbbyt.dll
C:\WINDOWS\system32\dqQACQAC1041.dll
C:\WINDOWS\downlo~1\CnsHook.dll
C:\WINDOWS\system32\ttHADHAD1071.dll
C:\WINDOWS\system32\wsctf.exe
2.删除重启后使用SREng修复下面各项： 启动项目 －－ 注册表之如下项删除：
[{a580305f-b902-4723-ac26-06e4cb4279a5}]
[{1f102fa9-e182-41f3-937b-b5418bfc43e4}]
[{3B1AEF69-DDAE-FDAD-DCAB-698F026ABDB3}]
[{9947e423-193f-4fc4-b38d-e76fdd799150}]
[{5fd0c12b-da0b-4446-82fd-b8041a46492b}]
[{df14157d-3ce2-4d9b-b0cc-7f47e3e31fdb}]
[{398C9B84-4EF7-47B5-9862-DE29543B3C42}]
[{5f24d354-e8fd-410e-8f85-35351ccc9eda}]
[{5f24d354-e8fd-410e-8f85-35351ccc9eda}]
[{d21ac220-ebb3-4110-9817-37aa0cce636b}]
[{2795a41a-41a3-46a6-8b43-876500e74240}]
注意该项[AppInit_DLLs]修改：把<ghjdtry.dll,dgxsrr.dll,lfsjgf.dll,stehs.dll,fghshj.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gjjte.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,kghk.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,lfsjgf.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,sperls.dll,>修改为<>即清空
<DXDLG32>
<MSDWG32>
<MSDCG32
<MSDOG32>
<MSDSG32>
<MSDMG32>
<MSDHG32>
<MSDQG32>
注意该项[Userinit]修改：把<userinit.exe,EXPLORER.EXE>修改为<C:\WINDOWS\system32\userinit.exe,>逗号不可省略
[{D157330A-9EF3-49F8-9A67-4141AC41ADD4}]
<{AEB6717E-7E19-11d0-97EE-00C04FD91972}>
<{2795a41a-41a3-46a6-8b43-876500e74240}>
<{d21ac220-ebb3-4110-9817-37aa0cce636b}>
<{5f24d354-e8fd-410e-8f85-35351ccc9eda}>
<{398C9B84-4EF7-47B5-9862-DE29543B3C42}>
<{df14157d-3ce2-4d9b-b0cc-7f47e3e31fdb}>
<{5fd0c12b-da0b-4446-82fd-b8041a46492b}>
<{9947e423-193f-4fc4-b38d-e76fdd799150}>
<{3B1AEF69-DDAE-FDAD-DCAB-698F026ABDB3}>
<{1f102fa9-e182-41f3-937b-b5418bfc43e4}>
<{D157330A-9EF3-49F8-9A67-4141AC41ADD4}>
<{a580305f-b902-4723-ac26-06e4cb4279a5}>
<EXPLORER.EXE>
<wsctf.exe>
启动项目 －－ 服务－－ 驱动程序之如下项删除：
[obj2 / obj2]
[ndliphrb / ndliphrb]
[msfpfis64 / msfpfis64]
[mnsf / mnsf]
[fmsq / fmsq]
[CnsMinKP / CnsMinKP]
系统修复－－ 浏览器加载项之如下项删除：
[] <C:\WINDOWS\system32\oohxbbyt.dll>
[] <C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys>
[] <C:\WINDOWS\system32\oohxbbyt.dll>
[] <C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys>
[CnsHook Class] <C:\WINDOWS\downlo~1\CnsHook.dll>
[AutoLive] <C:\PROGRA~1\3721\autolive.dll>
[CnsHook Class] <C:\WINDOWS\downlo~1\CnsHook.dll>
最后下载以下软件清理一次并更新杀毒软件至最新，进行全盘杀毒
清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe 用金山清理专家清理恶意软件
http://www.duba.net/zt/ksc/down.shtml 下载 windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.zip
