在安全模式下显示隐藏文件(我的电脑-文件夹选项-查看-隐藏受保护的操作系统文件 去掉前面的钩）删除
C:\WINDOWS\csrss.exe
C:\WINDOWS\system32\jfevgkva.dll
C:\WINDOWS\system32\xxyayax.dll
C:\WINDOWS\system32\awvvu.dll
c:\windows\system32\壁纸自动换.exe
<C:\WINDOWS\system32\xxyayax.dll
<C:\WINDOWS\system32\awvvu.dll
<C:\WINDOWS\system32\dkbprphd.dll
<%windir%\Network Diagnostic\xpnetdiag.exe
<C:\WINDOWS\DOWNLO~1\SSREAD~1.DLL,
<C:\WINDOWS\system32\aliedit\AliEdit.dll
<C:\WINDOWS\system32\xxyayax.dll
<%SystemRoot%\system32\msxml3.dll
<C:\PROGRA~1\VIEWGOOD\WEBPLA~1\VGPlayer.dll
<C:\WINDOWS\system32\IETool.dll
<C:\WINDOWS\system32\jwflxbiu.dll
c:\WINDOWS\system32\shmgoruv.dll
C:\WINDOWS\system32\dkbprphd.dll
SREng 启动项目-注册表 选中删除
<csrss>
<GPLv3>
<{0868E7A4-82FD-48ED-942F-AC7CEC0280C3}>
<WinlogonNotify: awvvu>
<switch>
SRE—系统修复—浏览器加载项 删除
[]
{0868E7A4-82FD-48ED-942F-AC7CEC0280C3} <C:\WINDOWS\system32\xxyayax.dll, N/A>
[]
{37348005-0029-4685-90D9-11D22ABAC24A} <C:\WINDOWS\system32\awvvu.dll, N/A>
[]
{5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} <C:\WINDOWS\system32\dkbprphd.dll, N/A>
[kele8]
{84920E5F-3788-49cd-A274-E365578DF174} <http://www.kele8.com/, N/A>
[]
{e2e2dd38-d088-4134-82b7-f2ba38496583} <%windir%\Network Diagnostic\xpnetdiag.exe, N/A>
[SSReaderPlug]
{1DE88635-1C72-401E-B23B-93FA86D30F3B} <C:\WINDOWS\DOWNLO~1\SSREAD~1.DLL, 北京超星>
[CEditCtrl
Object]
{488A4255-3236-44B3-8F27-FA1AECAA8844} <C:\WINDOWS\system32\aliedit\AliEdit.dll, www.alipay.com>
[]
{0868E7A4-82FD-48ED-942F-AC7CEC0280C3} <C:\WINDOWS\system32\xxyayax.dll, N/A>
[XML DOM Document]
{2933BF90-7B36-11D2-B20E-00C04F983E60} <%SystemRoot%\system32\msxml3.dll, N/A>
[WebVGPlayer Class]
{AA899B43-24BD-4B6B-BBD0-45557D8D11E0} <C:\PROGRA~1\VIEWGOOD\WEBPLA~1\VGPlayer.dll, >
[Thunder]
{BE830FD4-E393-417F-9F4B-CC70ABB3384C} <C:\WINDOWS\system32\IETool.dll, N/A>
[]
{E12BFF69-38A7-406E-A8EF-2738107A7831} <C:\WINDOWS\system32\jwflxbiu.dll, N/A>
