Trojan. psw. zhengtu. DM, Trojan. psw. lmir. ATB

EndurerOriginal
1Version

When a netizen started his computer just now, Rising's boot scanning detected a virus: Trojan. psw. zhengtu. DM, Trojan. psw. lmir. ATB, then rising monitoring umbrellas become red, and all monitoring cannot be enabled. Please help me.

Check the record history of rising stars:
----------------
C:/tcnewtcnew. dllTrojan. psw. zhengtu. DM
C:/docume ~ 1/ABC/locals ~ 1/tempwin3.exeTrojan. psw. lmir. ATB
C:/docume ~ 1/ABC/locals ~ 1/tempwin8.exeTrojan. psw. lmir. ATB
----------------
All deleted.

Scan logs with hijackthis (which you can download to the http://endurer.ys168.com) to discover suspicious processes:C:/Windows/system32/winmer.exe, Terminated.

Find the file and scan it with rising stars.Trojan. psw. lmir. ATB.

Manual check, found:

C:/520.exe
C:/520zt.exe

Two suspicious files.

Check System Service: The system service "rising process Communication Center" used by rising is missing, and the "rsravmon service" is stopped. Start it manually. The system prompts:

The rsravmon service cannot be started on the local computer.
Error 1075: the dependent service does not exist or has been marked as deleted.

Export the HKEY_LOCAL_MACHINE/system/controlset001/services/rsccenter key from the computer of another user who uses rising to import it to the user's computer.

After a netizen's computer restarts, the rising monitoring center can finally start all monitoring tasks.