Manually scan and kill the latest Javqhc Trojan variants in three steps

Source: Internet
Author: User

Source: Beijing Network

Introduction to Javqhc:
If you have a problem, the trojan may be in use, and v1.9, the latest Javqhc exclusive killer tool of 360, is no longer available.

1. Security Software Hard Disk

File deleted

Security software such as 360 and diagnostic tools cannot be opened and deleted immediately after running.

2. Frequently Used domain names are hijacked to other domain names

The trojan will modify the hosts table, and upgrade the server, homepage, and Forum domain names of security vendors such as Qihoo 360, Kaspersky, Jinshan, Jiangmin, rising, and Symantec, all Hosts With the IP address 222.73.126.115 are hijacked. The image is fake Baidu network, and the domain name is displayed as cn.yahoo.com.

3. Write virus files to the installation directory of Common Software

Wsock32.dll is found in the qq installation directory in the system.

Step 1: Use Wsyscheck to detect viruses
When almost all of the security software is paralyzed, the unpopular software can be used. Wsyscheck is a tool used to manually clean up viruses and Trojans. It aims to simplify the identification and cleaning of viruses and Trojans. By using it, you can see the modules loaded by viruses into each process, to determine the module, c: windowssystem32pgwtjfxv. oct (it may be a random name, and the extension should be. OCT) This file is loaded into almost every process, which explains why the kill tool is deleted.

Step 2: manually remove viruses with WinPE
Go to the WinPE system and find c: windowssystem32pgwtjfxv. oct and delete it, and then create a bpgwtjfxv manually. the immune directory of oct, and create a new one in the directory .. the ending directory makes it impossible for viruses to delete the immune directory and restart the system.

Step 3: completely eliminate viruses
After entering the system normally, you can run 360 to install 360 security guard to scan for malware, repair the damaged Hosts, and use the Javqhc killing tool to clear the residual files.

Related Article

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.