服务删除
[Windows frpg RunThem / frpg][Stopped/Auto Start]
<C:\WINDOWS\System32\svchost.exe -k netsvcs-->C:\PROGRA~1\amkb\kwul.dll><N/A>
注册表不正常项目:
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><rsjzapm.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{2A1247C1-53DA-FF43-ABD3-345F323A48D2}><C:\WINDOWS\System32\avwgbmn.dll> [N/A]
<{12FAACDE-34DA-CCD4-AB4D-DA34485A3421}><C:\WINDOWS\System32\rsjzapm.dll> []
<{2B681598-AD5F-BC8C-77DC-748FAC8D3FB2}><C:\WINDOWS\System32\kafybzy.dll> []
这些需要处理,方法参照这个帖子搞
http://forum.ikaka.com/topic.asp?board=28&artid=8346236
还有一点
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ZGNotify]
<WinlogonNotify: ZGNotify><MyNotification.dll> []