这里官网下载费尔木马强力清除助手,勾选“清除,并抑制文件再次生成”后删除。
http://dl.filseclab.com/down/powerrmv.zipc:\windows\system32\pwdmon.dll
c:\windows\system32\midimapcq.dll
c:\windows\system32\midimapzx.dll
c:\windows\system32\midimapwl.dll
c:\windows\system32\midimapqn3.dll
c:\windows\system32\midimapwd.dll
c:\windows\system32\midimaptl.dll
c:\windows\system32\wyrsdj.dll
c:\windows\system32\jdsaex.dll
c:\windows\system32\sgrefg.dll
c:\windows\system32\jhrcar.dll
c:\windows\system32\rfdswc.dll
c:\windows\system32\cedafb.dll
c:\windows\system32\jfrwdh.dll
c:\windows\system32\mfdesy.dll
c:\windows\system32\zgfdet.dll
c:\windows\system32\tisqatyu.dll
c:\docume~1\quwei\locals~1\temp\1.tmp
c:\windows\system32\d32dx9.sys
2.删除重启后使用SREng修复下面各项: 启动项目 -- 注册表之如下项删除:
[midimapcq]
[midimapzx]
[midimapwl]
[midimapqn3]
[midimapwd]
[midimaptl]
[{19109876-7619-9101-7012-901938475191}]
[{4F4F0064-71E0-4f0d-0023-708476C7815F}]
[{4F4F0064-71E0-4f0d-0005-708476C7815F}]
[{50940F85-F015-14F1-A05F-F69858AC6D05}]
[{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}]
[{B29583D8-033A-4B9F-8553-7C5458F3FB8E}]
[{8C41B7F7-3168-400D-A702-0E7EFE0BA304}]
[{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}]
[{461D2AB4-29A5-45C2-9134-D52272D3DE38}]
[{84143967-B645-4BFF-B873-DA1DC886E9A7}]
[{841529CB-7F77-4B99-A895-B5441E0D302F}]
[{EB71E0B3-E97D-4D30-8733-E28266467617}]
[{DC3D30AE-0380-4151-8934-EE98A34B0370}]
[{28EB3777-3E23-4E72-8449-A992D09D24C3}]
[{1DB3C525-5271-46F7-887A-D4E1ADAA7632}]
[{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}]
[{4A069845-2036-6084-9054-6087502480A4}]
[{35671234-7890-ABCD-CDEF-567801237653}]
[{81954FAC-1023-154F-895A-1458258AD818}]
[{6A041F13-A111-12A3-B0CF-F99818AA68A6}]
[{33512378-9874-5641-1025-985420368733}]
[{17AC9076-C898-B098-D098-A18319080971}]
[{18093456-9012-4568-9076-908765467181}]
[{2D698451-2015-6358-9871-2015987452D2}]
[{9A59145F-315D-BC23-AC1F-145DF81A34A9}]
[{4C648541-1025-9650-9057-6541258720C4}]
[{6C8D1401-A58D-A81C-CD24-A5915C4517C6}]
[{4F4F0064-71E0-4f0d-0004-708476C7815F}]
[{4F4F0064-71E0-4f0d-0022-708476C7815F}]
[{4F4F0064-71E0-4f0d-0018-708476C7815F}]
[{4F4F0064-71E0-4f0d-0017-708476C7815F}]
[MSMSGS] <; >
启动项目 -- 服务-- 驱动程序之如下项删除:
[IIS Manager / IIS Manager ]
[HiddFldy / HiddFldy]
系统修复-- 浏览器加载项之如下项删除:
[] <C:\WINDOWS\system32\tisqatyu.dll>
[] <C:\WINDOWS\system32\tisqatyu.dll>
做完下载以下软件清理一次并更新杀毒软件至最新进行全盘杀毒一次
清理系统临时文件和IE临时文件夹
http://www.atribune.org/public-beta/ATF-Cleaner.exe 用金山清理专家清理恶意软件
http://www.duba.net/zt/ksc/down.shtml 下载 windows清理助手清理一遍
http://www.arswp.com/download/arswp2/arswp2.zip然后参考这里:
http://bbs.ikaka.com/showtopic-8508653.aspx将补丁打上