http://bbs.ikaka.com/showtopic-8417665.aspx#3487007找到ctfmon.exe放到C:\Window\system32下替换被感染的文件这些是什么呢，建议提交到瑞星或可疑文件区，等待回复，但问题是我不记得地址了。。C:\WINDOWS\system32\svclost.exe
C:\WINDOWS\system32\installer32.sys
建议使用XDelBox(下载地址：
http://bbs.ikaka.com/attachment.aspx?attachmentid=446806）
删除以下文件：（使用说明：删除时复制所有要删除文件的路径，在待删除文件列表里点击右键选择粘贴.在要删除文件上点击右键，选择立刻重启删除，电脑会重启进入DOS界面进行删除操作。运行xdelbox前最好卸载所有可移动存储设备C:\WINDOWS\system32\msexe.exe
C:\WINDOWS\system32\zxexe.exe
C:\WINDOWS\system32\System.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\416887
C:\WINDOWS\anymie360.exe
C:\WINDOWS\system32\anymie360.exe
C:\WINDOWS\system32\HBmhly.dll
C:\WINDOWS\system32\mgljdlgp.dll
C:\WINDOWS\system32\mefapfkf.dll
C:\WINDOWS\system32\ghdkioch.dll
C:\WINDOWS\system32\alcccpda.dll
C:\WINDOWS\system32\hpjfofpi.dll
C:\WINDOWS\system32\jeohbfnk.dll
C:\WINDOWS\system32\hiipggnf.dll
C:\WINDOWS\system32\mldmgfie.dll
C:\WINDOWS\system32\ijlchbik.dll
C:\WINDOWS\system32\gjeljiej.dll
C:\WINDOWS\system32\kpbjdhdl.dll
C:\WINDOWS\system32\miejmkig.dll
C:\WINDOWS\system32\aefghlmp.dll
C:\WINDOWS\system32\bpofdiej.dll
C:\WINDOWS\system32\ineccmnb.dll
C:\WINDOWS\system32\jigjbnfk.dll
C:\WINDOWS\system32\pifpkgij.dll
C:\WINDOWS\system32\dmdnaihe.dll
C:\WINDOWS\system32\eamjoagi.dll
C:\WINDOWS\system32\odcpmdcc.dll
C:\WINDOWS\system32\iifpeknb.dll
C:\WINDOWS\system32\hdjggijk.dll
C:\WINDOWS\system32\copmecop.dll
C:\WINDOWS\system32\ijacjmdg.dll
C:\WINDOWS\system32\nmmifpcg.dll
C:\WINDOWS\system32\ipohgbhc.dll
C:\WINDOWS\system32\ofickgek.dll
C:\WINDOWS\system32\dhidcjid.dll
C:\WINDOWS\system32\ebafhceo.dll
C:\WINDOWS\system32\hklmlgek.dll
C:\WINDOWS\system32\gboijmki.dll
C:\WINDOWS\system32\accpekme.dll
C:\WINDOWS\system32\knapgbfe.dll
C:\WINDOWS\system32\linngdbe.dll
C:\WINDOWS\system32\ioklpajl.dll
C:\WINDOWS\system32\dklojoip.dll
C:\WINDOWS\system32\hpfkhinm.dll
C:\WINDOWS\system32\gmcnenbl.dll
C:\WINDOWS\system32\nkfcdaig.dll
C:\WINDOWS\system32\ggfgbdda.dll
C:\WINDOWS\system32\jdglhpfb.dll
C:\WINDOWS\system32\accgklap.dll
C:\WINDOWS\system32\pjiidiem.dll
C:\WINDOWS\system32\immfecnh.dll
C:\WINDOWS\system32\cddjkaib.dll
C:\WINDOWS\system32\iggkjnci.dll
C:\WINDOWS\system32\fmkchchd.dll
C:\WINDOWS\system32\aglkobii.dll
C:\WINDOWS\system32\idjkjpna.dll
C:\WINDOWS\system32\knnkbknp.dll
C:\WINDOWS\system32\ffhfbfih.dll
C:\WINDOWS\system32\ocjalcpb.dll
C:\WINDOWS\system32\agelefga.dll
C:\WINDOWS\system32\198FF3D8.dll
C:\1c86e3e44ce294f1.dat
C:\3d65faec9a36da1a.dat
C:\WINDOWS\System32\Drivers\msiffei.sys
2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
<msexe.exe><C:\WINDOWS\system32\msexe.exe>
<zxexe.exe><C:\WINDOWS\system32\zxexe.exe>
<HBService32><System.exe>
<svchstt><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\416887> []
<Alcmtr><anymie360.exe> []
<{47A90BFE-B2BD-4BBC-B071-B4DFDB950C3B}><C:\WINDOWS\system32\knapgbfe.dll> [File is missing]
<{198FF3D8-56F1-466B-A36F-F9C28B43E440}><198FF3D8.dll> []
<{4774B479-2F2F-49CF-A12B-867E20068797}><C:\WINDOWS\system32\knnkbknp.dll> []
<{52770DBE-F970-4487-9ED0-BF912974EDBD}><C:\WINDOWS\system32\linngdbe.dll> []
<{28459A35-5D6B-4355-8A63-4BFDC444E163}><C:\WINDOWS\system32\ioklpajl.dll> []
<{D4583829-C3CF-410F-A7E0-671FA2618516}><C:\WINDOWS\system32\dklojoip.dll> []
<{19F41276-9581-405E-96A7-B40F6C2AE09C}><C:\WINDOWS\system32\hpfkhinm.dll> []
<{06C7E7B5-713F-441C-B32E-088B114CD606}><C:\WINDOWS\system32\gmcnenbl.dll> []
<{74FCDA20-0DF4-44C7-A0D3-4AC4EE72CACC}><C:\WINDOWS\system32\nkfcdaig.dll> []
<{00F0BDDA-4997-4731-A911-CC58AF1884A9}><C:\WINDOWS\system32\ggfgbdda.dll> []
<{3D0519FB-25A6-4E33-B5EB-08F9A8225E4E}><C:\WINDOWS\system32\jdglhpfb.dll> []
<{ACC045A9-B1A9-4351-ADBB-EFB874D83848}><C:\WINDOWS\system32\accgklap.dll> []
<{9322D2E6-F8A1-4D0C-8F1E-46CCF985C88D}><C:\WINDOWS\system32\pjiidiem.dll> []
<{266FEC71-5BB4-4C0D-AA2E-CA30A356AF40}><C:\WINDOWS\system32\immfecnh.dll> []
<{CDD34A2B-4F55-4EB1-A106-22299B3D7289}><C:\WINDOWS\system32\cddjkaib.dll> []
<{200437C2-6112-402E-A5D4-03110CC8D61D}><C:\WINDOWS\system32\iggkjnci.dll> []
<{F64C1C1D-F398-40B7-BDBB-9D4E0B9FBF6E}><C:\WINDOWS\system32\fmkchchd.dll> []
<{A0548B22-1551-4CD0-B72F-1276099EA7C6}><C:\WINDOWS\system32\aglkobii.dll> []
<{2D34397A-38BB-4D93-B2B3-3340802988A4}><C:\WINDOWS\system32\idjkjpna.dll> []
<{FF1FBF21-0678-41E9-A366-EE540F3F56FA}><C:\WINDOWS\system32\ffhfbfih.dll> []
<{8C3A5C9B-C95A-4DDC-B209-D17559A0FFA3}><C:\WINDOWS\system32\ocjalcpb.dll> []
<{A0E5EF0A-F9F2-467A-B09B-7E08CCCA9546}><C:\WINDOWS\system32\agelefga.dll> []
<6053D509><> [N/A]
<6EFA9F4F><> [N/A]
<01D428C1><> [N/A]
<A5CCC9DA><> [N/A]
<193F8F92><> [N/A]
<3E81BF74><> [N/A]
<1229007F><> [N/A]
<65D60F2E><> [N/A]
<235C1B24><> [N/A]
<03E532E3><> [N/A]
<49B3D1D5><> [N/A]
<62E36420><> [N/A]
<AEF01569><> [N/A]
<B98FD2E3><> [N/A]
<27ECC67B><> [N/A]
<3203B7F4><> [N/A]
<92F94023><> [N/A]
<D6D7A21E><> [N/A]
<EA638A02><> [N/A]
<8DC96DCC><> [N/A]
<22F9E47B><> [N/A]
<1D300234><> [N/A]
<C896EC89><> [N/A]
<23AC36D0><> [N/A]
<7662F9C0><> [N/A]
<29810B1C><> [N/A]
<8F2C40E4><> [N/A]
<D12DC32D><> [N/A]
<EBAF1CE8><> [N/A]
<145650E4><> [N/A]
<0B823642><> [N/A]
<ACC9E46E><> [N/A]
<47A90BFE><C:\WINDOWS\system32\knapgbfe.dll> [File is missing]
<4774B479><C:\WINDOWS\system32\knnkbknp.dll> []
<52770DBE><C:\WINDOWS\system32\linngdbe.dll> []
<28459A35><C:\WINDOWS\system32\ioklpajl.dll> []
<D4583829><C:\WINDOWS\system32\dklojoip.dll> []
<19F41276><C:\WINDOWS\system32\hpfkhinm.dll> []
<06C7E7B5><C:\WINDOWS\system32\gmcnenbl.dll> []
<74FCDA20><C:\WINDOWS\system32\nkfcdaig.dll> []
<00F0BDDA><C:\WINDOWS\system32\ggfgbdda.dll> []
<3D0519FB><C:\WINDOWS\system32\jdglhpfb.dll> []
<ACC045A9><C:\WINDOWS\system32\accgklap.dll> []
<9322D2E6><C:\WINDOWS\system32\pjiidiem.dll> []
<266FEC71><C:\WINDOWS\system32\immfecnh.dll> []
<CDD34A2B><C:\WINDOWS\system32\cddjkaib.dll> []
<200437C2><C:\WINDOWS\system32\iggkjnci.dll> []
<F64C1C1D><C:\WINDOWS\system32\fmkchchd.dll> []
<A0548B22><C:\WINDOWS\system32\aglkobii.dll> []
<2D34397A><C:\WINDOWS\system32\idjkjpna.dll> []
<FF1FBF21><C:\WINDOWS\system32\ffhfbfih.dll> []
<8C3A5C9B><C:\WINDOWS\system32\ocjalcpb.dll> []
<A0E5EF0A><C:\WINDOWS\system32\agelefga.dll> []
注意该项[AppInit_DLLs]修改：把<HBmhly.dll,mgljdlgp.dll,mefapfkf.dll,ghdkioch.dll,alcccpda.dll,hpjfofpi.dll,jeohbfnk.dll,hiipggnf.dll,mldmgfie.dll,ijlchbik.dll,gjeljiej.dll,kpbjdhdl.dll,miejmkig.dll,aefghlmp.dll,bpofdiej.dll,ineccmnb.dll,jigjbnfk.dll,pifpkgij.dll,dmdnaihe.dll,eamjoagi.dll,odcpmdcc.dll,iifpeknb.dll,hdjggijk.dll,copmecop.dll,ijacjmdg.dll,nmmifpcg.dll,ipohgbhc.dll,ofickgek.dll,dhidcjid.dll,ebafhceo.dll,hklmlgek.dll,gboijmki.dll,accpekme.dll,knapgbfe.dll,linngdbe.dll,ioklpajl.dll,dklojoip.dll,hpfkhinm.dll,gmcnenbl.dll,nkfcdaig.dll,ggfgbdda.dll,jdglhpfb.dll,accgklap.dll,pjiidiem.dll,immfecnh.dll,cddjkaib.dll,iggkjnci.dll,fmkchchd.dll,aglkobii.dll,idjkjpna.dll,knnkbknp.dll,ffhfbfih.dll,ocjalcpb.dll,agelefga.dll>改为<>即清空
==================================
启动文件夹
[19hero's come back]
<C:\Documents and Settings\Administrator\「开始」菜单\程序\启动\19hero's come back.mp3 --> [File is missing]><N>
这个是你自己的吗？不是的话就删了。==================================
启动项目 －－ 服务－－ 驱动程序之如下项删除：
(勾选隐藏已认证的微软项目,选中有问题的驱动/服务后，点"删除服务"，点"设置"按钮即可。注意弹出的窗口中要点"否NO"才是确认删除服务）
[1c86e3e44ce294f1 / 1c86e3e44ce294f1][Stopped/Manual Start]
<\??\C:\1c86e3e44ce294f1.dat><N/A>
[3d65faec9a36da1a / 3d65faec9a36da1a][Stopped/Manual Start]
<\??\C:\3d65faec9a36da1a.dat><N/A>
[msiffei / msiffei][Stopped/Manual Start]
<System32\Drivers\msiffei.sys><N/A>
[zg / zg][Running/]
usp10和psapi文件简易清理器.rar清理下
用下载的“清理临时文件工具ATF-Cleaner-cn”，全选所有项目，点击“立即清理”
下载：
http://bbs.ikaka.com/attachment.aspx?attachmentid=447126用W i n d o w s 清理助手 ，清理系统。
W i n d o w s 清理助手 下载：
http://www.arswp.com/
