首先使用附件工具
请使用Xdelbox删除以下文件（关于Xdelbox的下载使用请参考
http://bbs.ikaka.com/showtopic-8442813.aspx）
C:\WINDOWS\knx32.exe
C:\WINDOWS\system32\knx32.exe
C:\WINDOWS\system32\mttwfh.dll
C:\WINDOWS\system32\wzcfsw.dll
C:\WINDOWS\system32\wklsdd.dll
C:\WINDOWS\system32\ddserh.dll
C:\WINDOWS\system32\wrqszl.dll
C:\WINDOWS\system32\tdfhex.dll
C:\WINDOWS\system32\sgdewg.dll
C:\WINDOWS\system32\hhrdxd.dll
C:\WINDOWS\system32\zgtwfx.dll
C:\WINDOWS\system32\fsrgeb.dll
C:\WINDOWS\system32\nhmxfjkl.dll
C:\WINDOWS\system32\pedadt.dll
C:\WINDOWS\system32\tdggrz.dll
C:\WINDOWS\system32\jdsaex.dll
C:\WINDOWS\system32\fmcvxy.dll
C:\WINDOWS\system32\wyrsdj.dll
C:\WINDOWS\system32\zsdgff.dll
C:\WINDOWS\system32\jhfrxz.dll
C:\WINDOWS\system32\jfdses.dll
C:\WINDOWS\system32\dhyszj.dll
C:\WINDOWS\system32\kgfghd.dll
C:\WINDOWS\system32\360mon.dll
C:\WINDOWS\system32\Drivers\0011949c.sys
C:\WINDOWS\system32\Drivers\0011f01a.sys
C:\WINDOWS\system32\Drivers\00672100.sys
C:\WINDOWS\System32\Drivers\msiffei.sys
使用Sreng在注册表启动项目中
删除[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]下的
kcodn><knx32.exe> []
将[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]下的
<AppInit_DLLs><kmon.dll biroas.dll lensch.dll comboaus.dll woswelc.dll kandaof.dll rmchamp.dll,nhmxfjkl.dll cmonos.dll jolinos.dll dualey.dll hourpx2.dll dearnts.dll jacknove.dll> [N/A]改成<AppInit_DLLs><kmon.dll >
删除[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]下的
<{021F087F-4378-545F-74FA-37D345AD7A8C}><C:\WINDOWS\system32\mttwfh.dll> []
<{28766E1C-74B0-4417-8C75-F12AE309EF35}><C:\WINDOWS\system32\wzcfsw.dll> []
<{E8A3B193-77E3-4FB3-986D-F4FA4828BAFC}><C:\WINDOWS\system32\wklsdd.dll> []
<{A9895933-6636-4281-BC58-EE6DE2AF96E3}><C:\WINDOWS\system32\ddserh.dll> []
<{F99DEFDD-200B-4410-B572-E90883D527D2}><C:\WINDOWS\system32\wrqszl.dll> []
<{0B846B26-BFE6-4E8E-A948-1DB17B77B483}><C:\WINDOWS\system32\tdfhex.dll> []
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgdewg.dll> []
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> []
<{006CA8A1-61BC-4774-A54C-F49034270BAD}><C:\WINDOWS\system32\zgtwfx.dll> []
<{EA5D4B0E-B8CE-4761-8C7E-5D26369F0EC6}><C:\WINDOWS\system32\fsrgeb.dll> []
<{67AC9076-C898-B098-D098-A18319080976}><C:\WINDOWS\system32\nhmxfjkl.dll> []
<{5E907A48-400E-4EA8-9792-FFAE052D59E9}><C:\WINDOWS\system32\pedadt.dll> []
<{4D165A2A-4BC1-4CA8-8299-08E05AAAB5A4}><C:\WINDOWS\system32\tdggrz.dll> []
<{B29583D8-033A-4B9F-8553-7C5458F3FB8E}><C:\WINDOWS\system32\jdsaex.dll> []
<{73AE86E6-7F03-4C3B-8980-FB1DA157D3C7}><C:\WINDOWS\system32\fmcvxy.dll> []
<{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll> []
<{53D44DB6-E22B-4B17-97D3-572C96CCA6E1}><C:\WINDOWS\system32\zsdgff.dll> []
<{7914E0AA-ECCB-4311-B584-C49538227824}><C:\WINDOWS\system32\jhfrxz.dll> []
<{81AF1CF6-D1C9-4C6A-AC01-EDE54E71945B}><C:\WINDOWS\system32\jfdses.dll> []
<{272A3236-188A-4E8A-8675-868AF8A8D151}><C:\WINDOWS\system32\dhyszj.dll> []
<{50A8A8C4-EDC9-4ABD-A0A2-2E2418982189}><C:\WINDOWS\system32\kgfghd.dll> []
<{AEB6717E-7E19-21d2-97EE-00C04FD91972}><C:\WINDOWS\system32\360mon.dll> []
删除[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\xy3safe]
<WinlogonNotify: xy3safe><C:\WINDOWS\system32\360mon.dll> []
删除启动文件夹
[腾讯qq]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\腾讯qq.lnk --> D:\2008QQ\QQ.exe [TENCENT]><N>
最后进入安全模式使用windows清理助手清理系统
