中了网游盗号病毒，杀毒也清除不了。清除方法如下：
1.删除以下文件：
c:\windows\system32\tfsdmz.dll
c:\windows\system32\jhrcar.dll
c:\windows\system32\pedadt.dll
c:\windows\system32\fedadh.dll
c:\windows\system32\hfrdzx.dll
c:\windows\system32\wyrsdj.dll
c:\windows\system32\jhfrxz.dll
c:\windows\system32\hhrdxd.dll
c:\windows\system32\zjydcx.dll
c:\windows\system32\sgrefg.dll
c:\windows\system32\tdffdl.dll
msosping01.dll
msosdohs01.dll
msosfmsq02.dll
lyloadqr.exe
lyloadhr.exe
lyloadmr.exe
lyloadar.exe
lyloador.exe
lyleador.exe
lyloadbr.exe
dxdlg.exe
c:\windows\mfchlp32.exe
c:\windows\dndsioc.exe
c:\windows\fmbiost.exe
c:\windows\tciocp32.exe
c:\windows\ryfoxs.exe
c:\windows\fmsbbqi.exe
c:\windows\cmdbcs.exe
c:\windows\msccrt.exe
c:\windows\ucibmc.exe
c:\windows\rwjpbf.exe
c:\windows\upxdnd.exe
c:\documents and settings\user\local settings\temp\dat15.tmp
c:\windows\system32\6ac6d8e6.exe
c:\documents and settings\user\local settings\temp\usbcams3.sys
c:\documents and settings\user\local settings\temp\tmp1660.tmp
c:\windows\system32\drivers\msosmsfpfis64.sys
c:\documents and settings\user\local settings\temp\usbhcid.sys
c:\windows\system32\drivers\msosfpids32.sys
c:\documents and settings\user\local settings\temp\tmp165e.tmp
c:\windows\system32\drivers\dyspeedcd.sys
c:\documents and settings\user\local settings\temp\tmp1659.tmp
c:\windows\Downloaded Program Files\szqvlj.dll
c:\program files\internet explorer\plugins\newsys55.sys
c:\windows\system32\37e9d5e4.dll
c:\documents and settings\user\local settings\temp\dat14.tmp
c:\documents and settings\user\local settings\temp\dat15.tmp
c:\windows\system32\d3d9_32.dll
c:\windows\system32\cmdbcs.dll
c:\windows\system32\coyngd.dll
c:\windows\system32\fmbiost.dll
c:\windows\system32\fmsbbqi.dll
c:\windows\system32\kretio.dll
c:\windows\system32\psbuhd.dll
c:\windows\system32\ryfoxs.dll
c:\windows\system32\tciocp32.dll
c:\windows\system32\tygpuv.dll
c:\windows\system32\ucibmc.dll
c:\windows\system32\ulpcqt.dll
2.删除重启后使用SREng修复下面各项：
启动项目 －－ 注册表之如下项删除：
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
<WinShell><"C:\WINDOWS\system32\Rundll32.exe" "C:\WINDOWS\system32\shell32.dll",Control_RunDLL "C:\DOCUME~1\user\LOCALS~1\Temp\dat15.tmp"> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
<DAYEESPEEDCD><> [N/A]
<upxdnd><C:\WINDOWS\upxdnd.exe> []
<Kvsc3><C:\WINDOWS\mcpbcg.exe> []
<msccrt><C:\WINDOWS\msccrt.exe> []
<cmdbcs><C:\WINDOWS\cmdbcs.exe> []
<fmsbbqi><C:\WINDOWS\fmsbbqi.exe> []
<fmbiost><C:\WINDOWS\fmbiost.exe> []
<dndsioc><C:\WINDOWS\dndsioc.exe> []
<mfchlp32><C:\WINDOWS\mfchlp32.exe> []
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
<DXDLG32><DXDLG.exe> [N/A]
<MSDWG32><LYLoadbr.exe> [N/A]
<MSDCG32 ><LYLeador.exe> [N/A]
<MSDOG32><LYLoador.exe> [N/A]
<MSDSG32><LYLoadar.exe> [N/A]
<MSDMG32><LYLoadmr.exe> [N/A]
<MSDHG32><LYLoadhr.exe> [N/A]
<MSDQG32><LYLoadqr.exe> [N/A]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]
<AppInit_DLLs><msosping01.dll,msosdohs01.dll,msosfmsq02.dll> []此项为清空，保持AppInit_DLLs为空值既可
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
<{C0595A7E-2E2F-4B34-A83A-019270A0A464}><C:\WINDOWS\system32\tdffdl.dll> [N/A]
<{8C41B7F7-3168-400D-A702-0E7EFE0BA304}><C:\WINDOWS\system32\sgrefg.dll> [N/A]
<{45AADFAA-DD36-42AB-83AD-0521BBF58C24}><C:\WINDOWS\system32\zjydcx.dll> [N/A]
<{17DFD111-BF3A-4CB4-ADB0-88FCBFE69821}><C:\WINDOWS\system32\hhrdxd.dll> [N/A]
<{7914E0AA-ECCB-4311-B584-C49538227824}><C:\WINDOWS\system32\jhfrxz.dll> []
<{1E51C0FD-EE36-434B-AD2A-FD1FF3731C38}><C:\WINDOWS\system32\wyrsdj.dll> []
<{1DB3C525-5271-46F7-887A-D4E1ADAA7632}><C:\WINDOWS\system32\hfrdzx.dll> []
<{27D89EDA-2197-4DFC-B3DC-AF22C6CA23BB}><C:\WINDOWS\system32\fedadh.dll> []
<{5E907A48-400E-4EA8-9792-FFAE052D59E9}><C:\WINDOWS\system32\pedadt.dll> [N/A]
<{CAED0F3B-DF8B-4DBF-BB20-8DFBC3199068}><C:\WINDOWS\system32\jhrcar.dll> []
<{875E07B1-0614-43D9-A76E-D76A28AB3D7B}><C:\WINDOWS\system32\tfsdmz.dll> []
启动项目 －－ 服务 －－ Win32服务应用程序之如下项禁用：
[F8827C0E / F8827C0E] <C:\WINDOWS\system32\6AC6D8E6.EXE -d>
启动项目 －－ 服务－－ 驱动程序之如下项禁用：
[Sc Manager / Sc Manager] <\??\C:\DOCUME~1\user\LOCALS~1\Temp\usbcams3.sys>
[ping / ping] <\??\C:\DOCUME~1\user\LOCALS~1\Temp\tmp1660.tmp>
[msfpfis64 / msfpfis64] <\??\C:\WINDOWS\system32\drivers\msosmsfpfis64.sys>
[iCafe Manager / iCafe Manager] <\??\C:\DOCUME~1\user\LOCALS~1\Temp\usbhcid.sys>
[fpids32 / fpids32] <\??\C:\WINDOWS\system32\drivers\msosfpids32.sys>
[fmsq / fmsq] <\??\C:\DOCUME~1\user\LOCALS~1\Temp\tmp165E.tmp>
[dyspeedcd / dyspeedcd] <\??\C:\WINDOWS\system32\drivers\dyspeedcd.sys>
[dohs / dohs] <\??\C:\DOCUME~1\user\LOCALS~1\Temp\tmp1659.tmp>
系统修复－－ 浏览器加载项之如下项删除：
[IovGfubl Class] <C:\WINDOWS\DOWNLO~1\szqvlj.dll>
[] <C:\Program Files\Internet Explorer\PLUGINS\NewSys55.Sys>
>> 除非说明均为原创，如转载请注明来源于http://www.stormcn.cn/post/52.html
