How to manually delete the usp10.dll Virus

With Kabbah 2009 killing method http://bbs.youhua.com/viewthread.php? Tid = 88075
 
I don't know the infection of the usp10.dll virus there. It was very depressing, and the problem could not be solved after the system was re-installed several times. Later I found that all local EXE files were infected, even if the system is re-installed and the EXE file on the local computer is installed, the attack will occur. I thought it was because all executable files were infected and I immediately analyzed the EXE files. After two days of tossing, it was both anti-virus and analysis, and it was ineffective. The final conclusion was as follows:

1. If you are infected with a friend, please reinstall the system, install the system with a network card, directly download the german red umbrella online, and install it. Remember not to move other files on your computer after installing the system. You can directly download the german red umbrella to the disk of the newly installed system. Generally, it is a drive C, which can be directly installed to kill software.

2. After the software is installed,

Enter security mode.

Search/delete thumbs. DB under all directories on all disks (including hidden files-click more advanced options-> select search to search for hidden files and folders)

Search/delete usp10.dll (including hidden files) with a size of approximately 38kb in all directories on all disks. ** other 400 k/K files are system files. Do not delete them. Because usp10.dll has variants, not all of which are 38 kb. After searching, you can check the file generation date and easily determine whether the file is a virus or a system file. The 38 K mentioned here is a symptom of my computer infection.

Finished. Reboot normally

Finally, I understand the principle of the virus infection as follows. As long as you pay attention to the standard operation, it is easy to clear the virus.

This trojan uses the system to access the Directory and reads thumbs. database to execute malicious code and generate usp10.dll in the Windows directory, because many programs call the system's usp10.dll during execution. call Sequence-> current directory-> path specifies the directory. then, the system calls the usp10.dll in windows, and then generates the usp10.dll in the current directory of each program. copy the file. I do not know whether the file has been modified to the EXE file yet.

I was depressed for a few days before doing a good job (fortunately, I didn't reinstall the system, even if I had reinstalled it. if other disks have infected thumbs. DB is the same, so I have already checked [do not cache thumbnails] in Resource Manager> Tools> Folder Options> View> to avoid generating thumbs. DB ). I hope to help you ..

Here, we have not used the software kill. Why should we install it? In order to prevent you from accidentally operating the software and virus infection. I have determined that red umbrellas are resistant to this virus, and other anti-virus solutions are useless, including the November, rising, and Kabbah, because the General virus is now used to stop the mainstream software kill, so I want to install the not-commonly used big-name Soft kill, that is, the German red umbrella.

First, you must enter the security mode to obtain the admin permission.

Open the search (enter the F3 key in the blank area on the desktop), and then choose tools> Folder Options> View to hide the protected operating system files (recommended) "Close and select" show all files and folders ". Then, enter the "usp10.dll" full drive character in the search box to search. Remember, the usp10.dll in C:/Windows/system32 and C:/Windows/system32/dllcache are not viruses, and all other folders are viruses.

You can delete all the items after the search. However, it should be noted that a usp10.dll in C:/Windows cannot be deleted as its original name. You can change its name and suffix. After the change, search for the name you just changed and delete it.

Go back to the Windows interface and try to search again. If you find it again, go back to safe mode and delete it. If it cannot be found, it is deleted. Of course, it cannot be ruled out that there are still potential machines. After all, the usp10.dll is damaged. Please wait for the kill tool.