Delete the notepad virus automatically running at startup

1. Open the task manager and end the wincfgs process.
2. Control Panel-Folder option-set to display system files and hidden files
3. Delete c: \ windows \ kb20060111.exe (the file name may be different and the blue icon is the same as that in Notepad ).
4. Delete c: \ windows \ system32 \ wincfgs.exe (the hidden system file of the yellow question mark icon ).
5. Start-run-Regedit-go to the Registry Editor
6. Delete the registry items respectively.
HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ WINDOWS
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ WINDOWS
The key value in the load registry key.
7. In the Registry-[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run], clear boot items related to wincfgs. (Because step 1 has been deleted, if you do not see wincfgs related items, skip this step)
8. Delete the empty notepad virus body when the USB flash drive or mp3 is started.
Do not double-click the USB flash drive or mp3 drive, right-click the drive, or select Open in English.
Open the USB flash drive/MP3 and you will see the recycler folder. Delete
Delete autorun. inf.

There is also a convenient way to batch Delete registry modifications:
Copy the following text to notepad and save it as "wins_s_kill.bat" (note that the file type is "all files" when saving ")

Echo off
Tskill kb20060111
Tskill wincfgs
Del % WinDir % \ kb20060111.exe
Del % WINDIR % \ system32 \ wincfgs.exe
Reg Delete "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows"/V "LOAD"/F
Reg Add "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Windows"/V "LOAD"/T REG_SZ/D ""/F