virus characteristics: Sxs.exe,autorun.inf files are automatically generated in each packing directory, and some are generated SVOHOST.exe or sxs.exe under Windows\System32, and the file attributes are implied attributes. Disable antivirus software automatically.
Sxs.exe Virus Manual Removal method
Ctrl + Alt + Del Task Manager, look in the process for SxS or svohost (not svchost, one letter), and then end it (not all systems show this process, skip this step).
Show hidden files, and if not, open WordPad to save the following code as the "Show hidden system files. reg" file, and then run!
Copy Code code as follows:
Windows Registry Editor Version 5.00
[Hkey_local_machine\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]
"Regpath" = "software\\microsoft\\windows\\currentversion\\explorer\\advanced"
"CheckedValue" =dword:00000001
(remove virus from startup Item) Open registry Run--regedit
Hkey_local_machine>software>microsoft>windows>currentversion>run
Find SVOHOST.exe or Sxs.exe or soundmam (note not soundman, only one letter) key value, there may be two, delete the key value of which is c:\\windows\system32\svohost.exe.
Open Notepad to copy the following code and save it as "Orange August SxS tool. Bat" file, and then run!
Copy Code code as follows:
Echo.
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
@echo:: Stop the running SXS.EXE and SVOHOST.EXE process, please wait ...
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
taskkill/f/t/im SXS. Exe
taskkill/f/t/im Svohost. Exe
taskkill/f/t/im ROSE. Exe
Color 4F
Color 0C
Color 4F
Color 0C
Color 4F
Color 0C
Echo.
Echo.
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
@echo:: Restore items in the registry that do not show hidden files to settings, please wait
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
ECHO Windows Registry Editor Version 5.00>showall.reg
ECHO [hkey_local_machine\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]> >showall.reg
ECHO "CheckedValue" =->>showall.reg
ECHO [hkey_local_machine\software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall]> >showall.reg
ECHO "CheckedValue" =dword:00000001>>showall.reg
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
@echo:: Delete the SXS.EXE, svohost in the system directory. EXE and WINSCOK.DLL files, please wait ...
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
Attrib-r-h-s-A%systemroot%\system32\sxs. Exe
Attrib-r-h-s-A%systemroot%\system32\svohost. Exe
Attrib-r-h-s-A%systemroot%\system32\winscok. Dll
del/f/q/a-r-h-s-a%systemroot%\system32\sxs. Exe
del/f/q/a-r-h-s-a%systemroot%\system32\svohost. Exe
del/f/q/a-r-h-s-a%systemroot%\system32\winscok. Dll
Attrib-r-h-s-A%systemroot%\sxs. Exe
Attrib-r-h-s-A%systemroot%\svohost. Exe
Attrib-r-h-s-A%systemroot%\winscok. Dll
del/f/q/a-r-h-s-a%systemroot%\sxs. Exe
del/f/q/a-r-h-s-a%systemroot%\svohost. Exe
del/f/q/a-r-h-s-a%systemroot%\winscok. Dll
Attrib-r-h-s-A%systemroot%\system\sxs. Exe
Attrib-r-h-s-A%systemroot%\system\svohost. Exe
Attrib-r-h-s-A%systemroot%\system\winscok. Dll
del/f/q/a-r-h-s-a%systemroot%\system\sxs. Exe
del/f/q/a-r-h-s-a%systemroot%\system\svohost. Exe
del/f/q/a-r-h-s-a%systemroot%\system\winscok. Dll
Attrib-r-h-s-A%systemroot%\system32\dllcache\sxs. Exe
Attrib-r-h-s-A%systemroot%\system32\dllcache\svohost. Exe
Attrib-r-h-s-A%systemroot%\system32\dllcache\winscok. Dll
del/f/q/a-r-h-s-a%systemroot%\system32\dllcache\sxs. Exe
del/f/q/a-r-h-s-a%systemroot%\system32\dllcache\svohost. Exe
del/f/q/a-r-h-s-a%systemroot%\system32\dllcache\winscok. Dll
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
@echo:: Delete SXS.EXE and Autorun.inf files under each partition, please wait ...
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
For%%a in (c:d: e:f: g:h: i:j: k:l: m:n: o:p: q:r: S:t: u:v: w:x: y:z:) do attrib-r-h-s-a%%a\sxs. EXE & del/f/q/a-r-h-s-a%%a\sxs. EXE & Attrib-r-h-s-A%%a\autorun. INF & del/f/q/a-r-h-s-a%%a\autorun. Inf
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
@echo:: Delete the boot entry from the registry, please wait ...
To @echo::::--::::::: £ º: £ º;;:--;:::::::;:: £ º:::,-::,----
ECHO Windows Registry Editor Version 5.00>soundmam.reg
ECHO [-hkey_local_machine\software\microsoft\windows\currentversion\run\soundmam]>>soundmam.reg
ECHO [Hkey_local_machine\software\microsoft\windows\currentversion\run]>>soundmam.reg
ECHO "Soundmam" =->>soundmam.reg
REGEDIT/S Soundmam.reg
del/f/q Soundmam.reg
REGEDIT/S Showall.reg
del/f/q Showall.reg
Color 3f
Echo.
@echo virus file is cleared!
Echo.
Echo.
Echo.
@echo
@echo
@echo
@echo
@echo
@echo
@echo
Echo.
@echo
Echo.
@echo
Echo.
@echo
Echo.
@echo
Echo.
Echo.
Echo.
Echo.
Pause
Echo.
Echo.
Echo.
Echo.
Echo.
Echo.
Echo.
To remove the bat for each disk virus file:
Copy Code code as follows:
Cd
C:
attrib sxs.exe-a-h-s
DEL/S/q/f Sxs.exe
attrib autorun.inf-a-h-s
DEL/S/q/f Autorun.inf
D:
attrib sxs.exe-a-h-s
DEL/S/q/f Sxs.exe
attrib autorun.inf-a-h-s
DEL/S/q/f Autorun.inf
E:
attrib sxs.exe-a-h-s
DEL/S/q/f Sxs.exe
attrib autorun.inf-a-h-s
DEL/S/q/f Autorun.inf
F:
attrib sxs.exe-a-h-s
DEL/S/q/f Sxs.exe
attrib autorun.inf-a-h-s
DEL/S/q/f Autorun.inf
G:
attrib sxs.exe-a-h-s
DEL/S/q/f Sxs.exe
attrib autorun.inf-a-h-s
DEL/S/q/f Autorun.inf
