Manually scan and kill the latest Javqhc Trojan variants in three steps

Source: Beijing Network

Introduction to Javqhc:
If you have a problem, the trojan may be in use, and v1.9, the latest Javqhc exclusive killer tool of 360, is no longer available.

1. Security Software Hard Disk

File deleted

Security software such as 360 and diagnostic tools cannot be opened and deleted immediately after running.

2. Frequently Used domain names are hijacked to other domain names

The trojan will modify the hosts table, and upgrade the server, homepage, and Forum domain names of security vendors such as Qihoo 360, Kaspersky, Jinshan, Jiangmin, rising, and Symantec, all Hosts With the IP address 222.73.126.115 are hijacked. The image is fake Baidu network, and the domain name is displayed as cn.yahoo.com.

3. Write virus files to the installation directory of Common Software

Wsock32.dll is found in the qq installation directory in the system.

Step 1: Use Wsyscheck to detect viruses
When almost all of the security software is paralyzed, the unpopular software can be used. Wsyscheck is a tool used to manually clean up viruses and Trojans. It aims to simplify the identification and cleaning of viruses and Trojans. By using it, you can see the modules loaded by viruses into each process, to determine the module, c: windowssystem32pgwtjfxv. oct (it may be a random name, and the extension should be. OCT) This file is loaded into almost every process, which explains why the kill tool is deleted.

Step 2: manually remove viruses with WinPE
Go to the WinPE system and find c: windowssystem32pgwtjfxv. oct and delete it, and then create a bpgwtjfxv manually. the immune directory of oct, and create a new one in the directory .. the ending directory makes it impossible for viruses to delete the immune directory and restart the system.

Step 3: completely eliminate viruses
After entering the system normally, you can run 360 to install 360 security guard to scan for malware, repair the damaged Hosts, and use the Javqhc killing tool to clear the residual files.