| 引用: |
【lei-wong的贴子】帮我再看看这个,哪些可以删除!
……………… |
针对35楼的日志：
1、用XDELBOX删除下列文件：
C:\WINDOWS\System32\9178F63E.DLL
C:\WINDOWS\System32\LYMANGR.DLL
C:\WINDOWS\system32\zinforms.dll
C:\WINDOWS\System32\winforms.dll
C:\WINDOWS\System32\Kvsc3.dll
C:\WINDOWS\System32\GenProtect.dll
C:\WINDOWS\System32\AVPSrv.dll
C:\WINDOWS\System32\mppds.dll
C:\WINDOWS\System32\MsIMMs32.dll
C:\WINDOWS\System32\NVDispDrv.dll
C:\WINDOWS\System32\MsPrint32D.dll
C:\WINDOWS\System32\cmdbcs.dll
C:\WINDOWS\System32\msccrt.dll
C:\WINDOWS\System32\DbgHlp32.dll
C:\WINDOWS\System32\upxdnd.dll
C:\WINDOWS\IGM.exe
C:\WINDOWS\DiskMan32.exe
C:\WINDOWS\AVPSrv.exe
C:\WINDOWS\MsPrint32D.exe
C:\WINDOWS\GenProtect.exe
C:\WINDOWS\Kvsc3.exe
C:\WINDOWS\MsIMMs32.exe
C:\WINDOWS\mppds.exe
C:\WINDOWS\msccrt.exe
C:\WINDOWS\cmdbcs.exe
C:\WINDOWS\upxdnd.exe
C:\WINDOWS\DbgHlp32.exe
NVDispDrv><C:\WINDOWS\NVDispDrv.exe
C:\WINDOWS\System32\LYLoader.exe
C:\WINDOWS\System32\LYLoadbr.exe
C:\WINDOWS\System32\LYLeador.exe
C:\WINDOWS\System32\LYLoador.exe
C:\WINDOWS\System32\LYLoadar.exe
C:\WINDOWS\System32\LYLoadmr.exe
C:\WINDOWS\System32\LYLoadhr.exe
C:\WINDOWS\System32\LYLoadqr.exe
C:\WINDOWS\System32\6A86F54C.EXE
C:\WINDOWS\System32\DRIVERS\odtmnb19.sys
C:\WINDOWS\System32\drivers\kfjhki.sys
C:\Program Files\yok\adblock.dll
C:\Program Files\yok\adblock.dll
C:\Autorun.inf
C:\auto.exe
D:\Autorun.inf
D:\auto.exe
E:\Autorun.inf
E:\auto.exe
F:\Autorun.inf
F:\auto.exe
G:\Autorun.inf
G:\auto.exe
2、用SRENG删除下列注册表内容：
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<CnsM.dll><Rundll32.exe C:\PROGRA~1\3721\CnsM.dll,Rundll32> [N/A]
<DiskMan32><C:\WINDOWS\DiskMan32.exe> []
<AVPSrv><C:\WINDOWS\AVPSrv.exe> []
<MsPrint32D><C:\WINDOWS\MsPrint32D.exe> []
<GenProtect><C:\WINDOWS\GenProtect.exe> []
<Kvsc3><C:\WINDOWS\Kvsc3.exe> []
<MsIMMs32><C:\WINDOWS\MsIMMs32.exe> []
<mppds><C:\WINDOWS\mppds.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<DbgHlp32><C:\WINDOWS\DbgHlp32.exe> []
<NVDispDrv><C:\WINDOWS\NVDispDrv.exe> []
<WinSysM><C:\WINDOWS\IGM.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<MSDEG32><LYLoader.exe> []
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> []
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><winforms.dll> []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{AEB6717E-7E19-11d0-97EE-00C04FD91974}><winforms.dll> []
<{AEB6717E-7E19-11d0-97EE-00C04FD91975}><zinforms.dll> []
服务
[FB66E62C / FB66E62C][Stopped/Auto Start]
<C:\WINDOWS\System32\6A86F54C.EXE -k><Microsoft Corporation>
驱动程序
odtmnb1 / odtmnb19][Stopped/Boot Start]
<\SystemRoot\System32\DRIVERS\odtmnb19.sys><N/A>
[kfjhki / kfjhki][Running/Boot Start]
<\SystemRoot\\SystemRoot\System32\drivers\kfjhki.sys><N/A>
浏览器加载项
[@shdoclc.dll,-866]
{c95fe080-8f5d-11d2-a20b-00aa003c157a} <, N/A>
[YOKHttpFilter Class]
{686D3343-D00D-49A1-96DF-66F3AF62F348} <C:\Program Files\yok\adblock.dll, N/A>
[YOKAdBlock Class]
{718F4AD3-70D4-425E-9159-5598DFC732ED} <C:\Program Files\yok\adblock.dll, N/A>
