Another application of ntsd

Many people should know the application of the ntsd command in windows. It is a process debugging. Program What I want to talk about today is its very small application-working with the del command to manually deal with stubborn virus files.
I have encountered several such viruses: anti-virus software cannot run, and the virus program runs again immediately after the process ends. Because the virus program is still running, other processes may monitor it, check the process every few seconds and immediately run the virus program (this is ideal) or create and run it (this is troublesome) without finding it ), I will introduce the general solution below.

The commands for force termination of processes in ntsd are described in the previous article (Process Termination commands and applications). Here we will briefly mention:
Ntsd-C q-p pid (PID is the process ID, which can be called up in the Task Manager)
Or
Ntsd-C q-PN ***. EXE (***. EXE is the process name, and exe cannot be saved)

If there is only one virus process, find the virus file. (If your eyes are bright enough, you can use the key value created in the registry run to determine its location, you can also find its location by viewing [system information]-[software environment]-[running task ).
What we need to do is to create a. bat or. CMD file _ They are all batch files that can be run directly under Win32. After the files are created with notepad (Notepad), enter the content:

Ntsd-C q-P virus program PID Complete del virus program path

For example, services.exe under C: \ WINDOWS is confirmed to be a virus program, and the PID of the Process number is 2233. (We recommend that you end the process with the PID because some of the virus names are the same as those of the system process, an error occurs when ntsd-C q-PN is used.) the following content should be entered:

Ntsd-C q-P 2233 Del/A/f c: \ windows \ services.exe

Save the text as a. bat or. CMD file and double-click it to run it.
In general, virus files are hidden attributes, so del needs to add/a, and some have read-only attributes, so add/F.

Because it is a batch file, you can append similar commands (if there are multiple virus files ):

Pid1 of ntsd-C q-P virus program Complete del virus program Path 1 Ntsd-C q-P virus program PID 2 Complete del virus program Path 2 .. .. ..

Generally, the problem can be solved, but you still need to review the antivirus software after updating the virus database (if the virus checking software is available at this time, otherwise, the hard disk can only be mounted to another user's machine for removal, dos for removal, or -- re-installation ).