"Mushroom" virus solution

Virus symptoms:
The virus file with the icon "mushroom" found in each disk sending area is displayed in the title bar of the program during running. To save the trouble, combine the two images provided by customer service into one.

Similar symptoms of Forum search:Http://bbs.duba.net/viewthread.php? Tid = 21837437 &; highlight = % C4 % A2 % B9 % BD

Simple Analysis and Processing of mushroom samples

Virus behavior:

Modify the registry for viruses and enable the system to bring up "My Documents ":
HKLMSOFTWAREMicrosoftWindowsCurrentVersionwinlogon/shell
HKCUSOFTWAREMicrosoftWindowsCurrentVersionun/server
HKLMSOFTWAREMicrosoftWindowsCurrentVersionun/explorer

Generated under each drive letter:
Autorun. inf
[X:]
[AutoRun]
Openjavaser.exe
Shellexecutepolicer.exe
Shellautocommand=er.exe
Shell = Auto

Release and modify the file and associate it with %systemroot=system32explorer.exe

Modified the file associations in the following format: *. exe *. ini *. inf *. txt

The drug overlord will solve the virus "mushroom" in today's regular upgrade. You can solve the problem manually for the time being.

Handling suggestion:
The virus creates Autorun. inf on each disk. Therefore, the virus program runs automatically after you double-click the drive letter. Deleting a virus fails. We recommend that you use Kingsoft cleaning experts to browse and delete these files.

C: windowssystem32explorer.exe (Note: Do not delete the explorer in the windows directory. This is the resource manager. If it is incorrect, the desktop cannot be restarted .)
C: assumer.exe (if there are multiple partitions, find these files in sequence and add them to the crushing list of the cleaning experts)

Run Sreng to fix file associations. If sreng cannot run, you can change the file extension to. com and run it again.


From: The Anti-Virus circle of tiejun