Manually clear hidden viruses and Trojans

Source: Internet
Author: User

Check Registry

The Registry has always been a parasitic place favored by many Trojans and viruses. Note that you must back up the registry before checking the registry.

1. Check HKEY_LOCAL_MACHINE/software/Microsoft/Windows/CurrentVersion/run and HKEY_LOCAL_MACHINE/software/Microsoft/Windows/CurrentVersion/runserveice in the registry, check whether there is any unfamiliar Automatic startup file in the key value. The extension is usually EXE, and remember the TrojanProgramThe file name, and then search in the entire registry. If you see the key value of the same file name, you need to delete it. Then you can find the hiding location of the Trojan file on your computer and delete it completely.

2. Check the items in the Registry HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER/software/Microsoft/Internet Explorer/main (such as local page). If the key value is changed, you just need to change it back based on your judgment. MaliciousCode(Such as "Wan Hua Gu.

3. Check whether the default open programs of common file types such as hkey_classes_root/INIFILE/Shell/Open/command and hkey_classes_root/txtfile/Shell/Open/command are changed. This must be changed back. Many viruses cannot be cleared by modifying default open programs such as. txt and. ini.

Check your system configuration file

The best way to check the system configuration file is to enable the Windows System Configuration handler program (run msconfig.exe from the Startup menu). You can configure config. sys, autoexec. bat, system. ini, and win. ini, and select the start time of the system.

1. Check the win. ini file (in C:/Windows? Windows? Below, "Run =" and "load =" are possible ways to load the "Trojan" program. You must pay attention to them carefully. Under normal circumstances, there is nothing behind their equal signs. If you find that there are paths and file names behind them that are not familiar with the Startup File, your computer may be "Trojan. For example, the "Gop Trojan" that attacks QQ will leave traces here.

2. Check the system. ini file (in C:/Windows/). There is a "shell = file name" under the boot file ". The specified file name should be "assumer.exefolder. If it is not" assumer.exe "but" shell = assumer.exe ", the program that follows is a" Trojan "program. Then you need to find the program on the hard disk and delete it.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.