What should I do after a trojan is detected in the system? The following describes some simple solutions.
1. Open the windows Task Manager and check whether there are any suspicious processes (you can determine based on the report of anti-virus software or search for related information on the Internet). If yes, end the process. Rundll32.exe in the system32directory is not a virus. It is possible that a dll file is running to be a virus or a malicious program.
Because the windows Task Manager cannot display the process path, we recommend that you use the process inspection and management tools that come with anti-virus software to find and stop suspicious processes. Then try to find the virus program file (mainly the virus process file you aborted). In addition, in the folder option of the Resource Manager, set to display all files and folders, and display protected files, check whether there are unknown dll or exe Files in the system32 folder, C: Program Files, C: Documents and SettingsuserLocal SettingsTemporary Internet Files, C: documents and SettingsuserLocal SettingsTemp and so on are there unknown files or virus program files), and then delete them to check whether the files are system files.
2. Some virus processes cannot be terminated, and the system prompts "Access Denied", or "repeated prohibitions. Based on my experience, there are three ways to try:
A. It may be that some Trojan viruses, rogue software, and so on have been registered as system services. The solution is to check the Control Panel> Management Tools> service, check whether there is any related service (especially the "Description" is empty), and stop it. Stop the virus process and delete it.
B. You can try anti-virus software in safe mode (Press F8 to select safe mode after boot). If not, try again in steps 1 and 2A.
C. Check the thread information and module information of the virus process by using tools such as the ice blade, try to disconnect the thread and remove the module, and try to delete the virus process file and the corresponding module. (Use with caution)
3. If you know how to use the registry, you can delete the relevant registry key value. General method: Start> Run, enter regedit, OK, open registry editor. Edit> search. The search target is the name of the virus process, and the related key values are deleted in the search results. Sometimes this does not prevent viruses, you should also try the method in step 2.
4. Some viruses may hijack the IE browser and cause the webpage to crash. We recommend that you use 360 security guard to check whether the browser's secondary object BHO has any suspicious items and whether there are no malicious plug-ins or Trojans. Fix it.
5. Other Tips: For better operations, please use the optimization master or Super Rabbit to clear all temporary files and cache files when surfing the Internet. Generally, viruses are stored in the Temporary Folder Temp, which helps you locate virus files faster.
Start> Run, enter msconfig, and click OK. You can open "System Configuration Utility ". Select "start" to check the programs loaded at startup. If a virus program is found in the program, it can be prohibited from loading at startup. However, this approach does not cure the symptoms, and is even ineffective for some programs. Follow Steps 1 and 2.
6. I have said so much, but sometimes it cannot be solved. I had to ask senior personnel or format and redo the system. Of course, the latter is not recommended.