Manually clear hidden viruses and Trojans

Check Registry

The Registry has always been a parasitic place favored by many Trojans and viruses. Note that you must back up the registry before checking the registry.

1. Check HKEY_LOCAL_MACHINE/software/Microsoft/Windows/CurrentVersion/run and HKEY_LOCAL_MACHINE/software/Microsoft/Windows/CurrentVersion/runserveice in the registry, check whether there is any unfamiliar Automatic startup file in the key value. The extension is usually EXE, and remember the TrojanProgramThe file name, and then search in the entire registry. If you see the key value of the same file name, you need to delete it. Then you can find the hiding location of the Trojan file on your computer and delete it completely.

2. Check the items in the Registry HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER/software/Microsoft/Internet Explorer/main (such as local page). If the key value is changed, you just need to change it back based on your judgment. MaliciousCode(Such as "Wan Hua Gu.

3. Check whether the default open programs of common file types such as hkey_classes_root/INIFILE/Shell/Open/command and hkey_classes_root/txtfile/Shell/Open/command are changed. This must be changed back. Many viruses cannot be cleared by modifying default open programs such as. txt and. ini.

Check your system configuration file

The best way to check the system configuration file is to enable the Windows System Configuration handler program (run msconfig.exe from the Startup menu). You can configure config. sys, autoexec. bat, system. ini, and win. ini, and select the start time of the system.

1. Check the win. ini file (in C:/Windows? Windows? Below, "Run =" and "load =" are possible ways to load the "Trojan" program. You must pay attention to them carefully. Under normal circumstances, there is nothing behind their equal signs. If you find that there are paths and file names behind them that are not familiar with the Startup File, your computer may be "Trojan. For example, the "Gop Trojan" that attacks QQ will leave traces here.

2. Check the system. ini file (in C:/Windows/). There is a "shell = file name" under the boot file ". The specified file name should be "assumer.exefolder. If it is not" assumer.exe "but" shell = assumer.exe ", the program that follows is a" Trojan "program. Then you need to find the program on the hard disk and delete it.