virus eraser

Kill macro Virus Step 1: First open your Excel, casually open a file on it. We mainly set the security. Find the tool on the menu bar, in the Tools menu, we click "Macros", in the macro's secondary menu, we find security, open the Security dialog box. Killing macro virus Step 2: In the Security dialog box, we tick very high: Only macros that are scheduled to be installed in a trusted location

Sometimes Win8 's own virus protection program is too sensitive to cause the deletion of things or interception of the program, and sometimes restore the system because in Safe mode can not restore success need to close the virus protection program. In this case, we need to turn off the virus protection program. So how does the Win8

After poisoning release the following files to the computer in recruit:C:\WINDOWS\system32\candoall.exeC:\WINDOWS\system32\alldele.iniC:\WINDOWS\system32\allinstall.exeC:\WINDOWS\system32\allread.iniC:\WINDOWS\system32\hideme.sysC:\WINDOWS\system32\MASSLTUAS35. DllC:\WINDOWS\system32\masxml32.dllC:\WINDOWS\system32\passsd.exeC:\WINDOWS\system32\ low price full membership. URLC:\WINDOWS\system32\ Low price filling drill. URLAlso, a bunch of messy virus

This is the latest variant of the Niu.exe virus, and recently the spread of new variants of the virus has been raised, I hope that attention. Quote: File:Discovery.exe size:74240 bytes Modified:2008 year February 2, 0:03:34 md5:2da55f2a36e852ee6fc96d34dd520979 Sha1:44ce8f1c1a02591a88867f421c0c658b200d94c1 crc32:e20e292d 1. After the virus runs, the following

File name: Video.exe File Size: 40960 bytes AV name: BACKDOOR.WIN32.IRCBOT.AFM (Kaspersky) Adding shell mode: Unknown Writing language: Microsoft Visual C + + Virus type: IRC back door File Md5:c06d070c232bc6ac6346cbd282ef73ae Behavioral Analysis: 1. Release virus copy: %srstemroot%system32\firewall.exe 40960 bytes. (The filename should be random, not necessarily this). Compress the replica

program based on the big spider engine also does not have the real-time monitoring function and cannot be automatically updated. 40. Emsisoft Emergency Kit Official Website: http://www.emsisoft.com/en/ The Austrian company "Emsisoft" has an astonishing detection rate and a high false positive rate. 41. Cert defense line Official Website: http://antiyfx.com/ Anti-Virus Software with very old qualifications in China has been transformed into pure green

Now the virus is really very powerful, so that anti-virus software can not start the normal has been very flattering. Recently I ghost.pif is this kind of virus, it in the antivirus software installation directory to forge a malicious ws2_32.dll file, resulting in anti-virus software at startup can not load the correct

failure phenomenon: The machine can be normal before the Internet, suddenly appear can be authenticated, not the phenomenon of the Internet (can not ping the gateway), restart the machine or under the Msdos window to run the command arp-d, but also to restore the Internet for a period of time. Failure Reason:This is caused by an APR virus spoofing attack. The cause of the problem is generally due to ARP Trojan attack. When using a plug-in or

Iexplore.exe is the main program for Microsoft Internet Explorer. This Microsoft Windows application allows you to surf the web and access the local Interanet network. This is not a pure system program, but if you terminate it, it may cause an unknown problem. Iexplore.exe is also part of the Avant web browser, a free Internet Explorer-based browser. Note that Iexplore.exe also may be a trojan.killav.b virus that will terminate your anti-

Modified:2008 year May 8, 18:52:32 md5:7009ac302c6d2c6aadede0d490d5d843 sha1:0e10da72367b8f03a4f16d875fea251d47908e1e crc32:dce5ae5a After virus runs: 1. Release a sbl.sys to the%system32%\drivers below, and copy a cover Beep.sys, then load the drive, restore SSDT hook, resulting in some anti-virus software active defense function failure. 2. End the process of many anti-

Recently a lot of people have this "beast" virus, the reason is called "beast" virus is because the virus is running, Folder Options hidden files in the text content has been modified to "animals have a bit of compassion, and I do not, so I am not an animal." ” This virus is actually a variant of the original analysis

This is a use of ANI to spread the Trojan Horse group, its "dynamic insertion process" function is caused by the difficulty of antivirus after the one of the reasons. Another: After the recruit, the system partition of the. exe is all infected. This is also the problem after the poison. "Symptoms" After the Recruit: Shualai.exe process is visible in the list of processes. Suggestion: Use Sreng to keep the log, in order to understand the basic situation, easy to the back of the manual antiviru

Imitate 36. Anti-Virus ~ Imitation 36 anti-virus button1 Style1 Attached: Http://www.cnblogs.com/yanjinhua/p/5643459.html

The virus generates the following files: Code: C:\WINDOWS\system32\1.inf C:\WINDOWS\system32\chostbl.exe C:\WINDOWS\system32\lovesbl.dll Create Autorun.inf and Sbl.exe under each partition and constantly detect whether the Chostbl.exe properties are hidden Registration service ANHAO_VIP_CAHW Point to C:\WINDOWS\system32\chostbl.exe, the purpose of boot up. Startup type: Automatic Display Name: A good DownLoad cahw Call the TerminateProcess function

Panda defender, from Europe's top kill virus software developer Panda Software unique concept and quality, the most advanced easy-to-use anti-virus software, perfect block from the internet all kinds of threats to computer security factors. Panda Antivirus 2008 Main new features: 1, to add new security early warning mechanism. By default, users are prevented from logging on to a known malicious site, rega

Virus name: TROJAN.DELF.RSD MD5 216a3783443fc9c46fe4d32aa13c390f After running the virus sample, automatically copy the copy to the%systemroot% directory %systemroot%\flashplay.dll %systemroot%\ge_1237.exe X:\flashplay.dll X:\readme.txt.exe X:\autorun.inf X refers to a non-system drive letter %systemroot% is an environment variable, What's inside Autorun.inf: [Autorun] Open=.\readme.txt.exe Shell\1=open

About Rundll2000.exe, also do not know is a what the virus. In the computer also did not find other strange elephants, there is no abnormal, is a little uncomfortable in the heart. The machine is our ... You don't want any uninvited guests. Rundll2000.exe Virus Manual cleanup Reboot the computer and enter Safe Mode (press F8 when the computer starts) Delete the following files: C:\Program files\internet Exp

Virus files include: 608769M. BMP crasos.exe Kernelmh.exe servet.exe ntmsoprq.exe RpcS.exe compmgmt.exe upxdnd.dll mppds.dll cmdbcs.dll Wsttrs.exe Ngr.exe iexpl0re.exe rundl132.exe update3.exe Servere.exe newinfo.rxk Removal Method: First, clear IE temporary files: Open IE point tool->internet option->internet temporary file-> point "delete Files" button-> will "delete all offline content" tick-> point "OK". Delete the following registry key with Sre

Releasing files Copy Code code as follows: %program files%\internet Explorer\plugins\autorun.inf %program files%\internet Explorer\plugins\pagefile.pif %program files%\internet Explorer\plugins\winnice.dll X:\Autorun.inf (x is not a system disk other letter) X:\pagefile.pif Add registry information such as Startup items Copy Code code as follows: Hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] { 06a68ad9-ff6

suspect a Trojan or virus, or if the system starts too slowly, use this tool to look at the startup item. The first time you run, the font displayed is very uncomfortable, please go to the menu "Options"-"font" set the font to "Arial" 9th, then no problem. Link: http://www.sysinternals.com/Files/Autoruns.zip V8.11 version download page: http://www.skycn.com/soft/17567.html QUOTE: Startuplist 1.52.1 Description: Foreign