Security Protection: Disable virus replacement of explorer files

Sometimes, when we use anti-virus software to clear the virus, the Desktop may not be displayed or the welcome interface will be stopped. What's going on? In fact, this is to replace the worms in the assumer.exe file. The solution is to copy a file named assumer.exe from a normal computer.

How can we replace the file "assumer.exe" with the worm?

In my experience, enable "Windows File Protection ". Some friends have deleted the C: Windowssystem32dllcache folder (protected System File Cache) to save space. In fact, this damages the "Windows File Protection" function and leaves a virus vulnerability.

Click "Start> Run", Enter CMD, and then enter the "sfc/scannow" command to enable Windows File Protection scanning. Then, check whether the dllcache folder is enabled. In "Group Policy, click "Local Group Policy> Computer Configuration> management template> system> Windows File Protection" (see figure ).

 

TIPS: replace system files with the same version number. If the version number is incorrect, it can be replaced successfully and run, but a series of strange things may occur, such as prompts such as "loading phone book failed error 5" during broadband dialing.