recently I got infected by virus about autorun.inf and printer.exe
when my usb thumb put in the computer it will replicate itself
to clean it
i surf the web
delete these keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
mswindws mssql.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
mswindws mssql.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
shell Explorer.exe work.exe
manually kill these processes using procexp from sysinternal or task manager:
%systemroot%\system32\cftmons.exe
%systemroot%\system32\work.exe
%systemroot%\system32\mssql.exe
del the files mentioned above
files are with hidden and system attrib
so using the command:
attrib -s -h cftmons.exe
and so on
No comments:
Post a Comment