建议使用XDelBox(下载地址：
http://bbs.ikaka.com/attachment.aspx?attachmentid=446806）
删除以下文件：（使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择剪贴板导入不检查路径，导入后记得勾选抑制其再生，在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储设备）
C:\WINDOWS\system32\lbganogp.dll
C:\WINDOWS\system32\nlmmiamp.dll
C:\WINDOWS\system32\fffmpmnm.dll
C:\WINDOWS\system32\ahffccle.dll
C:\WINDOWS\system32\aeplganb.dll
C:\WINDOWS\system32\lhmkekbk.dll
C:\WINDOWS\system32\HBSHQ.dll
C:\WINDOWS\system32\lgnjaoci.dll
C:\WINDOWS\system32\apmiepbo.dll
C:\WINDOWS\system32\pklbfigk.dll
C:\WINDOWS\system32\heinhaih.dll
C:\WINDOWS\system32\djpkkfbo.dll
C:\WINDOWS\system32\ahgdlpib.dll
C:\WINDOWS\system32\nlnmpoim.dll
C:\WINDOWS\system32\caabfbgj.dll
C:\WINDOWS\system32\iobnjbdc.dll
C:\WINDOWS\system32\clapcdbc.dll
C:\WINDOWS\system32\fkidkgin.dll
c:\windows\system32\config\software4.dat
c:\windows\system32\config\msciv1.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\msdfjsadfjd.dat
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\323356
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\wooolinit.dat
C:\WINDOWS\system32\0CFE34FA.dat
C:\WINDOWS\system32\System.exe
删除注册表项
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
<75662A69><C:\WINDOWS\system32\nlmmiamp.dll> []
<A1FFCC5E><C:\WINDOWS\system32\ahffccle.dll> []
<5073A8C2><C:\WINDOWS\system32\lgnjaoci.dll> []
<A962E9B8><C:\WINDOWS\system32\apmiepbo.dll> []
<945BF204><C:\WINDOWS\system32\pklbfigk.dll> []
<D3944FB8><C:\WINDOWS\system32\djpkkfbo.dll> []
<A10D592B><C:\WINDOWS\system32\ahgdlpib.dll> []
<75769826><C:\WINDOWS\system32\nlnmpoim.dll> []
<706AFAA5><C:\WINDOWS\system32\ngmafaal.dll> []
<C:\WINDOWS\Fonts\tgoriamb.dll><C:\WINDOWS\Fonts\tgoriamb.dll> []
<F5976DBC><C:\WINDOWS\system32\flpnmdbc.dll> []
<C:\WINDOWS\Fonts\dduebsta.dll><C:\WINDOWS\Fonts\dduebsta.dll> []
<76B3C361><C:\WINDOWS\system32\nmbjcjmh.dll> []
<C:\WINDOWS\fonts\opwvjfux.dll><C:\WINDOWS\fonts\opwvjfux.dll> []
<D24DFE39><C:\WINDOWS\system32\dikdfejp.dll> []
<CF28A853><C:\WINDOWS\system32\cfioaolj.dll> []
<E3AFE674><C:\WINDOWS\system32\ejafemnk.dll> []
<D0747395><C:\WINDOWS\system32\dgnknjpl.dll> []
<C:\WINDOWS\Fonts\tarsczgf.dll><C:\WINDOWS\Fonts\tarsczgf.dll> []
<91CF1ADF><C:\WINDOWS\system32\phcfhadf.dll> []
<D561FEF3><C:\WINDOWS\system32\dlmhfefj.dll> []
<567EC448><C:\WINDOWS\system32\lmneckko.dll> []
<BC0A2E1E><C:\WINDOWS\system32\bcgaiehe.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{75662A69-F998-4CCD-8189-18D08131A372}><C:\WINDOWS\system32\nlmmiamp.dll> []
<{A1FFCC5E-672A-4A22-AED8-7DB8B04207F4}><C:\WINDOWS\system32\ahffccle.dll> []
<{5073A8C2-AA3B-4973-AD6D-0988DDF6804A}><C:\WINDOWS\system32\lgnjaoci.dll> []
<{A962E9B8-F13E-4268-9A74-AD6B263CF3E0}><C:\WINDOWS\system32\apmiepbo.dll> []
<{945BF204-EB4F-42D7-8F5E-2192A5AD2631}><C:\WINDOWS\system32\pklbfigk.dll> []
<{D3944FB8-76E2-45FF-B074-04022429297C}><C:\WINDOWS\system32\djpkkfbo.dll> []
<{A10D592B-AD6B-4FE4-93BD-F20D916D2D55}><C:\WINDOWS\system32\ahgdlpib.dll> []
<{75769826-E933-4E7D-ADA7-86D027CE4325}><C:\WINDOWS\system32\nlnmpoim.dll> []
<{706AFAA5-1F13-4ECE-8584-4CB7703920D0}><C:\WINDOWS\system32\ngmafaal.dll> []
<{4B3DA347-ACBB-497B-B62F-957C4D2B46D3}><C:\WINDOWS\Fonts\tgoriamb.dll> []
<{F5976DBC-82F8-4D4A-85DB-C384BEE759F7}><C:\WINDOWS\system32\flpnmdbc.dll> []
<{76B3C361-8A8D-4798-A359-AB02665F5A78}><C:\WINDOWS\system32\nmbjcjmh.dll> []
<{77AC4257-6781-430B-80C1-BCA6D20C950F}><C:\WINDOWS\fonts\opwvjfux.dll> []
<{D24DFE39-5164-4471-AB05-68832DAF611D}><C:\WINDOWS\system32\dikdfejp.dll> []
<{CF28A853-C6B0-44D9-81EA-D3FDE8441E5E}><C:\WINDOWS\system32\cfioaolj.dll> []
<{E3AFE674-D037-4DE8-9676-C502982B6DDD}><C:\WINDOWS\system32\ejafemnk.dll> []
<{D0747395-B458-4A6B-9B89-ED87108A394E}><C:\WINDOWS\system32\dgnknjpl.dll> []
<{3CA7A137-35F8-46CD-B83B-534CD13D5A67}><C:\WINDOWS\Fonts\tarsczgf.dll> []
<{91CF1ADF-3F3E-4EE6-BAA0-DF4345E24D90}><C:\WINDOWS\system32\phcfhadf.dll> []
<{D561FEF3-1B86-4658-A96A-FD0E90594915}><C:\WINDOWS\system32\dlmhfefj.dll> []
<{567EC448-2015-41CC-8166-FD4E9B34CB80}><C:\WINDOWS\system32\lmneckko.dll> []
<{BC0A2E1E-939B-470D-9E91-2AFCCC293968}><C:\WINDOWS\system32\bcgaiehe.dll> []
删除服务
[Protected StorageManager / Protectedstoerg][Running/Auto Start]
<C:\WINDOWS\system32\svchost.exe -k netsvcs-->C:\WINDOWS\system32\config\software4.dat><N/A>
[MS Media Control Center / MediaCenter][Running/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k krnlsrvc-->C:\WINDOWS\system32\TkmdtoD.dll><@ Microsoft Corporation. All rights reserved.>
下载工具修复劫持项
http://bbs.ikaka.com/attachment.aspx?attachmentid=435625下载镜像劫持修复工具
用sreng工具清空<AppInit_DLLs>值为空<>。
这两个驱动有点可疑
C:\WINDOWS\system32\lddhzyxz.log
C:\WINDOWS\system32\drivers\zdiqeqd.sys
这个服务可疑
[mfc42 / mfc42][Running/Auto Start]
<c:\windows\mfc42.exe><N/A>
自己判断一下。
