开始→运行→输入services.msc，打开“服务”→查找 SDAgent Service→双击→启动类型→禁止→停止→应用→确定。禁止SDAgent Service这个服务
关闭所有浏览窗口以及一些不必要的程序
运行Hijackthis，扫描结束后在下列选项前打上勾，然后选"修复""
R3 - URLSearchHook: (no name) - {982CB676-38F0-4D9A-BB72-D9371ABE876E} - (no file)
R3 - URLSearchHook: SgUrlSearHook Class - {BAB1AC41-6FF7-4F2E-A04E-5C592CCFEA7D} - C:\WINNT\system32\socul.dll
O1 - Hosts: 172.16.0.196 union.dudu.com
O1 - Hosts: 172.16.0.196 dcww.dmcast.com
O1 - Hosts: 172.16.0.196 cojud.dmcast.com
O1 - Hosts: 172.16.0.196 corep.dmcast.com
O1 - Hosts: 172.16.0.196 coggdb.dudu.com
O1 - Hosts: 172.16.0.196 dcdl.dmcast.com
O1 - Hosts: 172.16.0.196 admin.dmcast.com
O1 - Hosts: 172.16.0.196 dcdlup.dmcast.com
O1 - Hosts: 172.16.0.196 ulink2.dudu.com
O1 - Hosts: 172.16.0.198 dudupack.dudu.com
O1 - Hosts: 172.16.0.198 rep.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 login.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 online.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 soft_rep.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 click.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 set_rep.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 update.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 dlup.dudupack.dudu.com
O1 - Hosts: 172.16.0.198 dl.dudupack.dudu.com
O2 - BHO: (no name) - {0005A87D-D626-4B3A-84F9-1D9571695F55} - (no file)
O2 - BHO: SohuDAIEHelper - {0CA51D02-7739-43EA-8D9A-1E8AD4327B03} - C:\Program Files\P4P\sodaie.dll (file missing)
O2 - BHO: ChajianHelper Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\WINNT\system32\SYSREA~1.DLL
O2 - BHO: QuickBtn - {1A199C20-DE2B-4838-AE3F-B5257ECE2B7E} - C:\Program Files\CoolWebsite\QuickLink.dll
O4 - 启动项HKLM\\Run: [win32tip] C:\Program Files\Internet Explorer\PLUGINS\mscorierdll.exe
O4 - 启动项HKLM\\Run: [Update] C:\Program Files\Common Files\UPDAT\Update.exe
O4 - 启动项HKLM\\Run: [res] C:\WINNT\system32\res.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: Sebring - C:\WINNT\system32\LgNotify.dll
O23 - NT 服务: SDAgent Service (SDAgentService) - 北京兴华基业软件技术有限公司 - C:\Program Files\Common Files\smartde\sde.exe
O18 - Filter: text/html - {83DFBFF3-1455-4538-8036-39D2057787DF} - C:\WINNT\gsSecurity1.dll
双击我的电脑--工具---文件夹选项--查看--单击选取"显示隐藏文件或文件夹"清除"隐藏受保护的操作系统文件（推荐）"复选框。在提示您确定更改时，单击“是”
(请按上述步骤操作，不要略过)
然后找到如下文件并删除（如果有的话）提示C:\PROGRA~1其实为C:\Program Files目录
C:\WINNT\system32\socul.dll
C:\WINNT\system32\SYSREA~1.DLL
C:\Program Files\CoolWebsite
C:\Program Files\Internet Explorer\PLUGINS\mscorierdll.exe（这个EXE能否用WINRAR打个包，通过邮箱传给我twtxk@126.com）
C:\Program Files\Common Files\UPDAT
C:\WINNT\system32\res.exe
C:\WINNT\system32\LgNotify.dll
C:\Program Files\Common Files\smartde
C:\WINNT\gsSecurity1.dll
修复后，请重启，再报个报告
粘上来。
