The last two days of virus rampant, a process called Wsttrs.exe will automatically terminate the virus firewall, and lead to the system desktop, the phenomenon of suspended animation. These viruses are very abnormal, the current rising Kabbah do not recognize:
First, manual removal method:
1. In Windows XP and above systems:
When you can't get to the desktop, bring up the Windows Task Manager (ctrl+alt+delete), switch to the Process tab, and then locate the Wsttrs.exe process, right-click to end the process, and display the desktop as normal.
2. When the above scheme does not succeed, it may be the latest variant of the virus, should enter Safe mode, open Registry Editor, navigate to Hkey_local_ Machinesoftwaremicrosoftwindowscurrentversionrunonce (note that RunOnce is not run)
Find Startup items that are located in the system disk windows or under the Winnt folder of the system disk. For example: Wstthrsc:windowswsttrs.exe or wstthrsc:winntwsttrs. Delete the change key value, restart the system can be.
Save the following file as. bat
Copy Code code as follows:
attrib c:\windows\wsdttrs.exe-a-h-s
Del C:\windows\wsdttrs.exe
MD C:\windows\wsdttrs.exe
attrib c:\windows\system32\wsdttrs.dll-a-h-s
Del C:\windows\system32\wsdttrs.dll
MD C:\windows\system32\wsdttrs.dll
attrib c:\windows\msccrt.exe-a-h-s
Del C:\windows\msccrt.exe
MD C:\windows\msccrt.exe
attrib c:\windows\mppds.exe-a-h-s
Del C:\windows\mppds.exe
MD C:\windows\mppds.exe
attrib c:\windows\dcoh.exe-a-h-s
Del C:\windows\dcoh.exe
MD C:\windows\dcoh.exe
attrib c:\windows\winform.exe-a-h-s
Del C:\windows\winform.exe
MD C:\windows\winform.exe
attrib c:\windows\conime.exe-a-h-s
Del C:\windows\conime.exe
MD C:\windows\conime.exe
attrib c:\windows\sysytem32\winform.exe-a-h-s
Del C:\windows\system32\winform.exe
MD C:\windows\system32\winform.exe
attrib c:\windows\sysytem32\winform.dll-a-h-s
Del C:\windows\system32\winform.dll
MD C:\windows\system32\winform.dll
attrib c:\windows\cmdbc.exe-a-h-s
Del C:\windows\cmdbc.exe
MD C:\windows\cmdbc.exe
attrib c:\windows\cmdbcs.exe-a-h-s
Del C:\windows\cmdbcs.exe
MD C:\windows\cmdbcs.exe
attrib c:\docume~1\admini~1\locals~1\temp\conime.exe-a-h-s
Del C:\docume~1\admini~1\locals~1\temp\conime.exe
MD C:\docume~1\admini~1\locals~1\temp\conime.exe
attrib c:\windows\system32\mci.dll-a-h-s
Del C:\windows\system32\mci.dll
MD C:\windows\system32\mci.dll
Exit
Kill tool Download
