Manual removal of "random 8-digit virus" and Security suggestions

Recently, the anti-virus center of Jiangmin detected that a virus using the "image hijacking" technology is rampant on the Internet. The main characteristics of this virus are: After the virus runs, A virus process with 8 random digits and letters will be generated, and multiple antivirus software, firewall, and security tool processes will be closed, making anti-virus operations difficult. The virus also generates Autorun under the root directory of each hard disk partition. inf and random 8-bit EXE, to double-click the hard disk to activate the virus, in addition, the virus will also spread through the U disk, MP3, mobile hard disk and other mobile storage, this greatly increases the virus transmission speed.
Jiang Min's anti-virus expert recommends that you take the following precautions when operating your computer:

1. keep your USB flash drive, MP3, mobile hard drive, and other mobile storage. When a foreign USB flash drive is connected to a computer, do not rush to double-click it to enable it. You must first take anti-virus measures, we recommend that you use anti-virus software with the USB flash drive Virus Immune Function. For example, the unique USB flash drive Security Technology of KV2007 can be used to protect all USB flash drive viruses by double-clicking the USB flash drive.

2. patch the system, especially the MS06-014 and MS07-17 patches, the vast majority of Web Trojans are intruded into the computer through these two vulnerabilities.

3. Update the antivirus software virus database in real time to regularly upgrade and prevent viruses.

4. Install software on a regular website to prevent the software installation package from being bundled with Trojans.

If no anti-virus software is installed or the anti-virus software is invalid, we recommend that you manually clear it as follows:

1. Download The iceswordtool online and change the Tool Name To abc.exe. This will allow the virus process to block the tool. Double-click the IceSword tool to end the process of an 8-digit EXE file. Sometimes this process may not exist.

2. Use the file management function of IceSword to expand to C: Program FilesCommon FilesMicrosoft SharedMSINFO and delete two 8-bit random numbers. The extensions are dat and dll. Go to the % windir % help directory and delete the. hlp or. chm file with the same name. The file is the system help file icon.

3. then delete Autorun under the root directory of each hard disk. inf file and suspicious 8-digit file. Note that you should not open each hard disk partition by double-clicking. Instead, you should use the tree directory on the left of Windows Resource Manager to browse. Sometimes computer viruses may fail to view hidden files. In this case, you can use the File Management Function of WinRar to browse and delete files.

4. Use the IceSword Registry management function to expand the registry key:
[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Options]
Delete the IFEO hijacking item.

In this case, you can install or enable anti-virus software, and then upgrade the anti-virus software to the latest virus database to completely eliminate viruses.