用IceSword，文件，设置，把禁止进线程创建的勾打上，找到下列进程，点右键，模块信息
选中加载的文件，点卸除
[PID: 612][\??\C:\WINDOWS\system32\winlogon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\WINDOWS\system32\winlib .dll] [N/A, N/A]
如找到上面的winlogon.exe进程，点右键，找到C:\WINDOWS\system32\winlib .dll点卸除
[PID: 1056][C:\WINDOWS\Explorer.EXE] [Microsoft Corporation, 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk] [N/A, N/A]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSym.dll] [N/A, N/A]
[PID: 1312][C:\Program Files\Rising\Rfw\RfwMain.exe] [Beijing Rising Technology Co., Ltd., 5, 0, 0, 66]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 1532][C:\Program Files\Rising\Rav\RavTask.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 7]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 1620][C:\Program Files\Rising\Rav\Ravmon.exe] [Beijing Rising Technology Co., Ltd., 19, 0, 0, 45]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyl.dll] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\LgSym.dll] [N/A, N/A]
[PID: 1752][C:\Program Files\Common Files\Real\Update_OB\realsched.exe] [RealNetworks, Inc., 0.1.0.3208]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 2068][C:\Program Files\Rising\KakaToolBar\runiep.exe] [Beijing Rising Technology Co., Ltd., 1, 0, 1, 6]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 2132][D:\Program Files\DAEMON Tools\daemon.exe] [DT Soft Ltd., 4.03.0.0]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 2172][C:\WINDOWS\system32\ctfmon.exe] [Microsoft Corporation, 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[PID: 2276][C:\WINDOWS\winlog0n.exe] [N/A, N/A]
[C:\WINDOWS\system32\LgSyl.dll] [N/A, N/A]
[PID: 2372][C:\WINDOWS\rundl132.exe] [N/A, N/A]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[PID: 2404][C:\WINDOWS\c0nime.exe] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[PID: 2744][C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Rar$EX00.829\SREng.EXE] [Smallfrogs Studio, 2.3.13.690]
[C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys] [N/A, N/A]
[C:\Program Files\Rising\KakaToolBar\ieprot.dll] [Beijing Rising Technology Co., Ltd., 1, 0, 0, 8]
[C:\WINDOWS\system32\LgSyza.dll] [N/A, N/A]
[C:\WINDOWS\system32\Gjzos.dll] [N/A, N/A]
[C:\WINDOWS\system32\LgSyl.dll] [N/A, N/A]
[C:\WINDOWS\system32\LgSym.dll] [N/A, N/A]
删除下列注册表项，并删除对应文件
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<ee59v9td4xd><C:\WINDOWS\winlog0a.exe> [N/A]
<0lz5misv50><C:\WINDOWS\iexpl0ra.exe> [N/A]
<wmc3wj><C:\WINDOWS\Servera.exe> [N/A]
<sv2y9g><C:\WINDOWS\rundl13a.exe> [N/A]
<wcbk><C:\WINDOWS\c0nima.exe> [N/A]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{A6011F8F-A7F8-49AA-9ADA-49127D43138F}><C:\Program Files\Common Files\Microsoft Shared\MSINFO\NewInfo.rxk> [N/A]
<{754FB7D8-B8FE-4810-B363-A788CD060F1F}><C:\Program Files\Internet Explorer\PLUGINS\SystemKb.sys> [N/A]
删除下列服务，及对应程序
[msndns / msndns][Stopped/Auto Start]
<C:\WINDOWS\msn.exe><N/A>
==================================
驱动程序
[acpidisk / acpidisk][Running/Auto Start]
<\??\C:\WINDOWS\system32\drivers\acpidisk.sys><N/A>不详
[dtscsi / dtscsi][Running/Manual Start]
<\SystemRoot\System32\Drivers\dtscsi.sys><N/A>不详
[EagleNT / EagleNT][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\EagleNT.sys><N/A>不详
[kmsinput / kmsinput][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\drivers\kmsinput.sys><N/A>不详
[Secdrv / Secdrv][Stopped/Manual Start]
<system32\DRIVERS\secdrv.sys><N/A>不详
删除下列驱动项，删除对应文件
[sptd / sptd][Running/Boot Start]
<\SystemRoot\System32\Drivers\sptd.sys><N/A>
[WINIO / WINIO][Stopped/Manual Start]
<\??\C:\WINDOWS\system32\winio.sys><N/A>
==================================
