How to thoroughly remove the candoall.exe Trojan

Candoall, can do all. Does it mean "Do whatever you want? What can we do? Look down! Very arrogant !!

After being poisoned, release the following files to the computer:
C: WINDOWSsystem32candoall.exe
C: WINDOWSsystem32alldele. ini
C: WINDOWSsystem32allinstall.exe
C: WINDOWSsystem32allread. ini
C: WINDOWSsystem32hideme. sys
C: WINDOWSsystem32MASSLTUAS35. DLL
C: WINDOWSsystem32masxml32. dll
C: WINDOWSsystem32passsd.exe
C: WINDOWSsystem32 low-cost filling member. url
C: WINDOWSsystem32 low-cost filling drill. url

Also, there are a bunch of messy virus-related files in the temporary IE folder.

In the IceSword Process List, the C: windowssystem32candoall.exepath displayed in the red letter is displayed (hidden paths are used in the iexplore.exe process.
Candoall.exe accesses the network through port 80 and repeatedly opens the main page http://www.investpoll.net.

The C: WINDOWSsystem32hideme. sys function of this virus is okay. When XDELBOX imports the above virus files through the clipboard, all reports that the files do not exist. Common methods (such as viewing files with WINRAR) cannot find these virus files.

After the move, the Registry changes as follows:

HKEY_CLASSES_ROOTAllDll.AllBHO
HKEY_CLASSES_ROOTAllDll.AllBHO.1
HKEY_CLASSES_ROOTCLSID {0ee2b1c1-0357-4505-a2e1-8e8e1a033ae5}
HKEY_CLASSES_ROOTCLSID {1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_CLASSES_ROOTCLSID {6233543C-2323-456A-A169-2E9C5E6E977B}
HKEY_CLASSES_ROOTInterface {E44384ED-10F7-49FD-A210-41C9BD4A119C}
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand Processor
"AutoRun" = "C: \ windows \ system32 \ candoall.exe"
HKEY_CLASSES_ROOTTypeLib {04750F2D-DE63-4790-90F4-C5CE892E5AA4} 1.0win32
@ = "C: \ windows \ system32 \ masxml32.dll"
Hkey_current_usersoftwaremicrosoftwindowscurrentversionpolicermountpoints2r
Hkey_current_usersoftwaremicrosoftwindowscurrentversionpolicermountpoints2 {f7b74df2-e1a1-11db-8a2e-806d6172696f}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsShellNoRoamBags6Shell
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetHardware Profiles001SoftwareMicrosoftwindowsCurrentVersionInternet Settings
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {0045D4BC-5189-4B67-969C-83BB1906C421}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {00C6482D-C502-44C8-8409-FCE54AD9C208}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {08B0E5C0-4FCB-11CF-AAA5-00401C608501}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {1798BEA6-E891-46B7-A1F8-C15780D0A023}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {5CA3D70E-1895-11CF-8E15-001234567890}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3}
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExtStats {92780b25-18cc-41c8-b9be-3c91_1a8263}
Hkey_current_usersoftwaremicrosoftwindowscur=versionextstats {D1A4DEBD-C2EE-449F-B9FB-E8409F9A0BC5}
Hkey_current_usersoftwaremicrosoftwindowscur=versionextstats {F040E541-A427-4CF7-85D8-75E3E0F476C5}
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceshideme
Where:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftCommand Processor
"AutoRun" = "C: \ windows \ system32 \ candoall.exe"
This loading method is rare.

Manual anti-virus process using IceSword:

1. End the C: windowssystem32candoall.exeprocess and iexplore.exe process.
2. Delete the following files:
C: WINDOWSsystem32candoall.exe
C: WINDOWSsystem32alldele. ini
C: WINDOWSsystem32allinstall.exe
C: WINDOWSsystem32allread. ini
C: WINDOWSsystem32hideme. sys
C: WINDOWSsystem32MASSLTUAS35. DLL
C: WINDOWSsystem32masxml32. dll
C: WINDOWSsystem32passsd.exe
C: WINDOWSsystem32 low-cost filling member. url
C: WINDOWSsystem32 low-cost filling drill. url
Clear the temporary IE folder.

3. Delete the preceding registry content added by the virus (HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceshideme must use a powerful tool such as IceSword to delete it ).