How to clear multiple iexpl0re. EXE files caused by gray pigeon

1. Disable System Restore before anti-virus (the win2000 system can be ignored): Right-click my computer, properties, system restore, and close the System Restore check on all drives.

Clear temporary ie files: Open the IE point tool --> Internet option: Internet temporary files. Click "delete file" to check all offline content and click "OK" to delete the temporary files.

Disable QQ and other applicationsProgram. Do not double-click the disk to open the disk. All downloaded tools are directly stored on the desktop.

2. Use the Force Delete tool powerrmv

Fill in the following files (including the complete path), select "Stop and stop killing objects again", and click "Destroy". If no prompt is found, ignore the error and continue]

CopyCode The Code is as follows: C: \ winnt \ system32 \ shellext \ smss.exe
C: \ winnt \ system32 \ IME/123
C: \ winnt \ g_server1.23.exe
C: \ winnt \ g_server1.23.dll
C: \ winnt \ g_server1.23_hook.dll
C: \ winnt \ g_server1.23key.dll
C: \ winnt \ server.txt
C: \ winnt \ svchost.exe

Restart the computer and then enter safe mode to perform the following operations:
--------------------------------------------------------------
The following operations must be performed in security mode.
[Security mode? Press F8 to enter safe mode when restarting the computer]
--------------------------------------------------------------

Click Edit for the following Sreng project:

Code:
Start Project --- Registry
[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
<Userinit> <c: \ winnt \ system32 \ userinit.exe, c: \ winnt \ system32 \ shellext \ smss.exe,> [N/A]
Edit
<Userinit> <c: \ winnt \ system32 \ userinit.exe,>

Use Sreng to delete the following items

[When Sreng is enabled, the system prompts "the function content is inconsistent with the expected value. They may be modified by some malicious software". Please ignore the error and modify the software after installation .]
In addition, note that some of the items mentioned in the above links are edited and cannot be deleted.
========================================

Code:
Start the project --> service --> Win32 service application to delete the following items
[Alookupsvc/aplication experience] [stopped/auto start]
<C: \ winnt \ system32 \ IME \ 123> <n/a>

[Gray_pigeon_server1.23/graypigeonserver1.23] [stopped/auto start]
<C: \ winnt \ g_server1.23.exe> <N/A>

[Serve/Server] [running/auto start]
<C: \ winnt \ server.txt> <N/A>

[Network Provisioning service/xmlprov] [stopped/auto start]
<C: \ winnt \ svchost.exe> <N/A>

Sreng repair location: System Repair ---> select all Windows Shell/IE, and click "Repair"

Sreng location: system repair --> hosts file, click "reset" in red ".

At last, I used a zombie to review other files. Remember to modify the passwords of accounts such as QQ and online games.