Questions about canceling the MTI and canceling the IPC $

Dear elites:
Most of our company's e-phones cannot access the website, and the printers cannot share the information. I checked it, I found that most of the computer's C-producer shares and IPC $ do not exist. I know it is a virus, but it cannot be accessed, maybe it's not just about Weijin's orders. Please give me some advice. If that friend knows something, please help. Too many.

========================================================== ==========================================================

I have found a worm with the same symptoms. All the default shares are deleted and the virus returns to normal. You can use the following method to check whether they are identical:
Open the "command prompt" and enter the following command

Dir C:/Windows/system32/*. */A: HS
If a file named winupdate.exe is found in the list, it proves to be the same as the virus I found.

If so, the elimination method is simple:
1: Open the worker task manager named “winupdate.exe.
2: Open "command prompt"
3: Enter the command:
C:
CD/Windows/system32
Attrib-r-H-s winupdate.exe
Del winupdate.exe
4: Open Registry Editor and delete the key value containing the string "winupdate.exe" under HKLM/software/Microsoft/Windows/CurrentVersion/run.