Trojan and virus removal through the Registry

There are more and more Internet friends, one of which is inevitably how to prevent and kill viruses and malicious attacks. However, what if there is no antivirus software around the virus? It doesn't matter. Today I will teach you how to easily and manually clear viruses and Trojans hidden in your computer.
Check Registry

The Registry has always been a parasitic place favored by many Trojans and viruses. Note that you must back up the registry before checking the registry.

To open the registry, click Start> Run and enter regedit ".

1. Check HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Run and HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ CurrentVersion \ Runserveice in the registry, check whether the key value contains an unfamiliar Automatic startup file with an extension of EXE. Remember the trojan file name and search the entire registry, if you see the key value of the same file name, you need to delete it. Then you can find the hiding place of the Trojan file on your computer and delete it completely? For example, the worm virus modifies the first item mentioned above, and the BO2000 Trojan modifies the second item mentioned above ).

2. Check the items in the Registry HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Internet Explorer \ Main (such as Local Page). If the key value is changed, you just need to change it back based on your judgment. Malicious Code (such as "Wan Hua Gu") often modifies these items.

3. Check whether the default open programs of common file types such as HKEY_CLASSES_ROOT \ inifile \ shell \ open \ command and HKEY_CLASSES_ROOT \ txtfile \ shell \ open \ command are changed. This must be changed back. Many viruses cannot be cleared by default by modifying programs such as. txt and. ini. For example, "Romeo and Juliette "? Bleblavirus modifies a large number of files (package .jpg?.rar=}and so on) to open the program by default.

Check your system configuration file

The best way to check the system configuration file is to enable the Windows system Configuration handler program (run msconfig.exe from the Startup menu). You can configure Config. sys, Autoexec. bat, system. ini, and win. ini, and select the start time of the system.

1. Check the win. ini file (in C? \ Windows? WINDOWS? Below, "run =" and "load =" are possible ways to load the "Trojan" program. You must pay attention to them carefully. Under normal circumstances, there is nothing behind their equal signs. If you find that there are paths and file names behind them that are not familiar with the Startup File, your computer may be "Trojan. For example, the "GOP Trojan" that attacks QQ will leave traces here.

2. Check the system. ini file (under C: \ windows \) and run "shell = file name" under the BOOT file ". The specified file name should be "assumer.exefolder. If it is not" assumer.exe "but" shell = assumer.exe ", the program that follows is a" Trojan "program. Then you need to find the program on the hard disk and delete it. There are many such viruses. This item will be changed to mongoshell‑policer.exe load.exe-dontrunold if the mongonimda virus is used ".