进注册表
打开
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
删除下面的键值
<{CEBB8F8A-308B-43E9-9789-B6FD6BE1BD97}><C:\WINDOWS\system32\v54M9wWBuNGTf2m.dll> []
<{427E02E6-39DB-4424-A49C-7553CD1331F5}><C:\WINDOWS\system32\WcCtgJ4zcxHF.dll> []
<{B8898C49-7B3A-4306-A9EF-8E186EDEE5EA}><C:\WINDOWS\system32\Qh6xX7VN48sVPnK.dll> []
<{69B265A2-A172-4D27-BDF1-917E6D8B1DCC}><C:\WINDOWS\fonts\jUxfqJDwmfQEHcy2.fon> []
<{0623DE09-E49D-4695-AA24-88BA7B58A395}><C:\WINDOWS\fonts\xPjWNGd8cERq.fon> []
<{49043CF7-E4A4-47D7-B393-E1523D262189}><C:\WINDOWS\system32\hNdcS96gQxDk.dll> []
<{122B901E-493F-4AD9-BC69-7DE8C3E52FCC}><C:\WINDOWS\system32\122B901E.dll> []
<{A0C86020-5935-4B87-B20E-0B656D450264}><C:\WINDOWS\system32\A0C86020.dll> []
<{AB900155-F1F0-4165-9E73-67BC13BBCE89}><C:\WINDOWS\system32\xg4hAPNygs29.dll> []
<{7A6359F5-6882-4FE9-B1CB-3130860BE4F3}><C:\WINDOWS\system32\BbXhGSfTsBbxT83aR.dll> []
<{76B9BA7A-81D0-4979-8598-8471F2AB5186}><C:\WINDOWS\system32\76B9BA7A.dll> []
<{9726072A-8039-4958-B609-565CF7A16B38}><C:\WINDOWS\system32\JPccCJnKygDdp3.dll> []
<{704C3595-DB85-40F6-A601-8D6F346907BD}><C:\WINDOWS\system32\704C3595.dll> []
<{08223B03-1B38-4A33-A83A-A4D3CC1D6E4E}><C:\WINDOWS\system32\08223B03.dll> []
<{37C5D66A-8B1B-4545-8112-3751194F6A4A}><C:\WINDOWS\system32\taNjsFa2tT2Dh.dll> []
<{36AC68E6-0C26-4D39-B98E-54B49DAB6BAA}><C:\WINDOWS\system32\dhDhwS7fFW.dll> []
<{1055CA44-51F8-486B-8CBD-DC7AD4213F1E}><C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon> []
<{91F5C9DB-ACD1-4812-BAB9-6F5AE433930A}><C:\WINDOWS\fonts\MbsV2QQJe.fon> []
<{E4814792-EFA3-4C20-93D0-8B130A59F9A8}><C:\WINDOWS\system32\E4814792.dll> []
<{E0528BDA-C850-4F23-93E4-7F907C1EF30E}><C:\WINDOWS\system32\BRv8dETwEzcN.dll> []
<{23DA65D2-C696-4EE4-BEE8-B4841DEC3E30}><C:\WINDOWS\system32\ndxq9awMc.dll> []
<{11B10F7F-FB23-466D-BDC3-9591CF02EC17}><C:\WINDOWS\fonts\uXUsF2RrQy.fon> []
<{F51687A3-607D-433E-B121-BD950D81E4DD}><C:\WINDOWS\system32\mz9BpCYkEfEa.dll> []
<{6B8FB03D-D56C-4D2A-A11A-5A28B9F3DE06}><C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon> []
<{93DA1E7D-7C46-4F90-8674-EC90511FCA72}><C:\WINDOWS\system32\CDuAUVkGy9.dll> []
<{41912A21-4337-4E99-8C30-80A8434B0793}><C:\WINDOWS\system32\zHvqM6hMxwpem.dll> []
<{A23CA53C-731F-4033-92E8-C1DFB4E71D34}><C:\WINDOWS\system32\JBn2ypqY23vWX.dll> []
<{A5CA6C70-7185-4466-AB45-B1C34E7A37CA}><C:\WINDOWS\system32\ed78ab9.dll> []
<{DA112397-5376-4E52-A333-A85284658DEA}><C:\WINDOWS\fonts\NPPVWvYEyCe8H.fon> []
<{F8C6B7B5-DAE0-4B78-BF2A-101C9A9CCA27}><C:\WINDOWS\system32\Va7SpUWgCA5f.dll> []
<{822775B8-E45B-4E55-9325-0753A0C1DC00}><C:\WINDOWS\system32\wdGSVBqAs3Xk.dll> []
<{38FEFE05-702C-440D-AD5C-B796209A1CC5}><C:\WINDOWS\system32\Y4npJWJNr.dll> []
<{50EBD6A5-0CF6-4E59-AE08-CCD991AA0596}><C:\WINDOWS\system32\GU6f5sW42mdc.dll> []
<{93F33500-527E-4E33-AECA-69B15243A90E}><C:\WINDOWS\system32\cRsAQd4hw.dll> []
<{737858A9-9AEA-4838-9B49-54DA731F7F37}><C:\WINDOWS\system32\BMsg6pdMD4ht.dll> []
打开
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
删除这个目录下的所有键值
提交
C:\WINDOWS\system32\6to4.dll
C:\WINDOWS\System32\appmgmts.dll
C:\WINDOWS\system32\qmgr.dll
C:\WINDOWS\system32\Ias.dll
C:\WINDOWS\system32\Iprip.dll
C:\WINDOWS\system32\ntmssvc.dll
C:\WINDOWS\system32\NWCWorkstation.dll
C:\WINDOWS\system32\Nwsapagent.dll
C:\WINDOWS\system32\MsPMSNSv.dll
C:\WINDOWS\system32\WmdmPmSp.dll
C:\WINDOWS\system32\drivers\klan.sys
C:\WINDOWS\system32\drivers\WmiSvc.sys
使用unlocker工具强制删除以下文件
[C:\WINDOWS\System32\COMRes.dll] [N/A, ]
[c:\windows\system32\6to4.dll] [N/A, ]
[c:\windows\system32\iprip.dll] [N/A, ]
[c:\windows\system32\ias.dll] [N/A, ]
[c:\windows\system32\qmgr.dll] [N/A, ]
[c:\windows\system32\appmgmts.dll] [N/A, ]
[c:\windows\system32\nwcworkstation.dll] [N/A, ]
[c:\windows\system32\nwsapagent.dll] [N/A, ]
[c:\windows\system32\mspmsnsv.dll] [N/A, ]
[c:\windows\system32\wmdmpmsp.dll] [N/A, ]
[c:\windows\system32\ntmssvc.dll] [N/A, ]
[C:\WINDOWS\system32\v54M9wWBuNGTf2m.dll] [N/A, ]
[C:\WINDOWS\system32\WcCtgJ4zcxHF.dll] [N/A, ]
[C:\WINDOWS\system32\Qh6xX7VN48sVPnK.dll] [N/A, ]
[C:\WINDOWS\fonts\jUxfqJDwmfQEHcy2.fon] [N/A, ]
[C:\WINDOWS\fonts\xPjWNGd8cERq.fon] [N/A, ]
[C:\WINDOWS\system32\hNdcS96gQxDk.dll] [N/A, ]
[C:\WINDOWS\system32\122B901E.dll] [N/A, ]
[C:\WINDOWS\system32\A0C86020.dll] [N/A, ]
[C:\WINDOWS\system32\xg4hAPNygs29.dll] [N/A, ]
[C:\WINDOWS\system32\BbXhGSfTsBbxT83aR.dll] [N/A, ]
[C:\WINDOWS\system32\76B9BA7A.dll] [N/A, ]
[C:\WINDOWS\system32\JPccCJnKygDdp3.dll] [N/A, ]
[C:\WINDOWS\system32\704C3595.dll] [N/A, ]
[C:\WINDOWS\system32\08223B03.dll] [N/A, ]
[C:\WINDOWS\system32\taNjsFa2tT2Dh.dll] [N/A, ]
[C:\WINDOWS\system32\dhDhwS7fFW.dll] [N/A, ]
[C:\WINDOWS\fonts\bQgc5yHMSD4yd.fon] [N/A, ]
[C:\WINDOWS\fonts\MbsV2QQJe.fon] [N/A, ]
[C:\WINDOWS\system32\E4814792.dll] [N/A, ]
[C:\WINDOWS\system32\BRv8dETwEzcN.dll] [N/A, ]
[C:\WINDOWS\system32\ndxq9awMc.dll] [N/A, ]
[C:\WINDOWS\fonts\uXUsF2RrQy.fon] [N/A, ]
[C:\WINDOWS\system32\mz9BpCYkEfEa.dll] [N/A, ]
[C:\WINDOWS\fonts\VBw9ZHsJt3M8tVgF.fon] [N/A, ]
[C:\WINDOWS\system32\CDuAUVkGy9.dll] [N/A, ]
[C:\WINDOWS\system32\zHvqM6hMxwpem.dll] [N/A, ]
[C:\WINDOWS\system32\JBn2ypqY23vWX.dll] [N/A, ]
[C:\WINDOWS\system32\ed78ab9.dll] [N/A, ]
[C:\WINDOWS\fonts\NPPVWvYEyCe8H.fon] [N/A, ]
[C:\WINDOWS\system32\Va7SpUWgCA5f.dll] [N/A, ]
[C:\WINDOWS\system32\wdGSVBqAs3Xk.dll] [N/A, ]
[C:\WINDOWS\system32\Y4npJWJNr.dll] [N/A, ]
[C:\WINDOWS\system32\GU6f5sW42mdc.dll] [N/A, ]
[C:\WINDOWS\system32\cRsAQd4hw.dll] [N/A, ]
[C:\WINDOWS\system32\BMsg6pdMD4ht.dll] [N/A, ]
用下面链接里的工具恢复正常的comres.dll文件
http://bbs.ikaka.com/attachment.aspx?attachmentid=542252
