One: Problems and symptoms:
virus, other virus files are good to kill. C:\WINDOWS\system32\cdsdf.exe anti-virus software can not kill. It is no use to inhibit regeneration after killing with POWERRMV. Please help me out.
Two: Analysis and solution:
1. Turn off System Restore before antivirus (Win2000 system can be ignored):
Right-click My Computer, properties, System Restore, turn off System Restore on all drives and tick.
Clear IE Temporary files: Open IE point tool-->internet option: Internet temporary files, click the "Delete Files" button, will delete all offline content tick, click OK Delete.
Close applications such as QQ. Do not do any double-click to open the disk until you do the following. All downloaded tools are placed directly on the desktop.
2. Delete the files listed below using the Force Removal Tool Xdelbox (file deletion terminator).
"Copy all the paths to delete files when you delete them, right-click on the file list you want to delete, and select Import from Clipboard. After the import to delete the file on the right click, choose to restart the deletion immediately, the computer will restart into the DOS interface for deletion, delete the completion will automatically restart into your installed operating system. Remember to save the document you are opening on your computer before you operate. For more information on Xdelbox, please see Help.chm in the xdelbox1.2 directory. 】
Copy Code code as follows:
C:\WINDOWS\system32\cdsdf.exe
C:\Program Files\Common Files\Microsoft Shared\msinfo\newinfo.rxk
C:\Program files\internet Explorer\plugins\systemkb.sys
C:\WINDOWS\system32\xpsp3res.dll
C:\WINDOWS\system32\kl.exe
C:\windows\system32\netw0r~1.exe
C:\WINDOWS\system32\fgdfsdf.exe
C:\WINDOWS\G_Server1.23.exe
C:\WINDOWS\G_Server1.23.dll
C:\WINDOWS\G_Server1.23_hook.dll
C:\WINDOWS\G_Server1.23key.dll
C:\progra~1\hwsy\ugji.dll
C:\WINDOWS\system32\explorcr.exe
C:\WINDOWS\system32\Rpcs.exe
C:\WINDOWS\avp.exe
C:\windows\System32\DRIVERS\bktybu25.sys
C:\WINDOWS\system32\drivers\cozlqk72.sys
C:\windows\System32\DRIVERS\jvardz24.sys
C:\windows\System32\DRIVERS\ukffsz58.sys
3. After restarting the computer, remove the following with tool Sreng
"The following operations are risky, and you must understand the above methods before you operate." 】
The contents of the "Sreng reminder after opening" function do not match the expected value they may be modified by some malicious software "Please ignore the error, install the normal modification after the soft." 】
==================================
Start Project--> the registry with the following deletion
<{a6011f8f-a7f8-49aa-9ada-49127d43138f}><c:\program Files\Common Files\Microsoft Shared\MSINFO\ newinfo.rxk> [n/A]
<{754fb7d8-b8fe-4810-b363-a788cd060f1f}><c:\program files\internet Explorer\plugins\systemkb.sys> [N/ A
==================================
Start the project--> service-->win32 The following item deletion of the service application
[Background intelligent Transfer Service/bits] [Stopped/auto Start]
<c:\windows\system32\svchost.exe-k netsvcs-->c:\windows\system32\xpsp3res.dll><n/a>
[dc0m Server Process launher/dc0r] [Stopped/auto Start]
<C:\WINDOWS\system32\kl.exe><N/A>
[DNS Cl1ent/dnscl1ent] [Running/auto Start]
<C:\WINDOWS\system32\NETW0R~1.EXE><N/A>
[SDHCVS/EDFSCV] [Stopped/auto Start]
<c:\windows\system32\fgdfsdf.exe-service><microsoft corporation>
[gray_pigeon_server1.2/graypigeonserver1.2] [Stopped/auto Start]
<C:\WINDOWS\G_Server1.23.exe><N/A>
[Std pbed service/pbed] [Stopped/auto Start]
<c:\windows\system32\rundll32.exe C:\progra~1\hwsy\ugji.dll,service-s><microsoft Corporation>
[Messaging/remote Procedure] [Stopped/auto Start]
<C:\WINDOWS\system32\explorcr.exe><N/A>
[Remote Procedure call System (RPCs)/RPCs] [Stopped/auto Start]
<C:\WINDOWS\system32\Rpcs.exe><N/A>
[Audio Adapter/vgadown] [Running/auto Start]
<C:\WINDOWS\avp.exe><N/A>
==================================
Start Project--> Service--> driver for the following items delete (if not deleted, set the type is disabled!)
[BKTYBU2/BKTYBU25] [Running/boot Start]
<\systemroot\system32\drivers\bktybu25.sys><microsoft corporation>
[cozlqk72/cozlqk72] [Stopped/manual Start]
<\?? \c:\windows\system32\drivers\cozlqk72.sys><n/a>
[Jvardz2/jvardz24] [Running/boot Start]
<\SystemRoot\System32\DRIVERS\jvardz24.sys><N/A>
[UKFFSZ5/UKFFSZ58] [Running/boot Start]
<\SystemRoot\System32\DRIVERS\ukffsz58.sys><N/A>
Sreng Repair Location: System repair--->windows shell/ie point Select All, point "fix"
Sreng Location: System repair--> repair Winsock provider point "Reset All content Defaults"
Finally use 360 security Guardian to download the address: Www.360safe.com can detect the full selection after the Point cleanup (delete)
