Manual processing is as follows:
Task Manager can end the process deletion of SXS. Remember to enter the hard disk with the right mouse button.
Press Ctrl+Shift+Esc at the same time to open the Windows Task Manager
Select the "Process" tab in it
Under Image Name, find "" but click it and select "End Process"
Be sure to end all "" processes
Open My Computer Click "Folder Options" under the Tools menu
Click the View tab to put the Advanced Settings
Checklist before "Hide protected operating system files (recommended)"
And select the "Show all files and folders" option below
Click OK
Right-click the C drive (no double-click!) Select "Open"
Delete the "" file and "" file under the C drive
Right-click on disk D and select "Open"
Delete the "" file and "" file under D disk (there is another file, which is also a .exe deleted it)
……
And so on Delete all files and "" files on disk
Click Start Select "Run" Enter "regedit" (without quotes) and enter
Expand My Computer > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Run
Delete the ROSE (c:) project in the Run item
Close the Registry Editor
Then restart the computer
Delete the hard disk and it is ROSE:
Press the shift key and insert the USB drive until the computer prompts "New hardware can be used"
Turn on my computer
At this time, right-click the icon on the USB flash drive and select "Open" (Don't click Automatic Play or double-click!)
Delete and file viruses are gone
Method 2:
Manual virus removal method
Features: Automatically generate files in each disk root directory, and some are also generated under Windows System32 or, the file attribute is an implicit attribute. Automatically disable antivirus software.
Ctrl + Alt + Del Task Manager, look for sxs or SVOHOST in the process (not SVCHOST, one letter different) and end it if there is one (not all systems show that there is this process, and if there is no one, skip this step).
(Show hidden system files)
HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL, change the Checked key value to 1
Note here that the virus will delete the originally valid DWORD value Checked, create an invalid string value Checked, type REG_SZ, and change the key value to 0! It is useless for us to change this to 1. Everyone should see the type after Checked. The correct one is "RED_DWORD" instead of "REG_SZ" (some virus variants will delete this Checked directly, just like the one below, and rebuild it yourself)
Method: Delete this Checked key value, right-click Create - name it Checked, and then modify its key value to 1, so that you can select "Show all hidden files" and "Show system files".
(Delete the virus autostart item) Open the registry and run it-regedit
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
or
Find SoundMam (note that it is not soundman, only one letter is missing) key value, there may be two, delete the key value of C:\
Then:
Delete the BAT of each disk virus file
Save the following code as bat
cd
c:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
D:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
E:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
F:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
G:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
Task Manager can end the process deletion of SXS. Remember to enter the hard disk with the right mouse button.
Press Ctrl+Shift+Esc at the same time to open the Windows Task Manager
Select the "Process" tab in it
Under Image Name, find "" but click it and select "End Process"
Be sure to end all "" processes
Open My Computer Click "Folder Options" under the Tools menu
Click the View tab to put the Advanced Settings
Checklist before "Hide protected operating system files (recommended)"
And select the "Show all files and folders" option below
Click OK
Right-click the C drive (no double-click!) Select "Open"
Delete the "" file and "" file under the C drive
Right-click on disk D and select "Open"
Delete the "" file and "" file under D disk (there is another file, which is also a .exe deleted it)
……
And so on Delete all files and "" files on disk
Click Start Select "Run" Enter "regedit" (without quotes) and enter
Expand My Computer > HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Run
Delete the ROSE (c:) project in the Run item
Close the Registry Editor
Then restart the computer
Delete the hard disk and it is ROSE:
Press the shift key and insert the USB drive until the computer prompts "New hardware can be used"
Turn on my computer
At this time, right-click the icon on the USB flash drive and select "Open" (Don't click Automatic Play or double-click!)
Delete and file viruses are gone
Method 2:
Manual virus removal method
Features: Automatically generate files in each disk root directory, and some are also generated under Windows System32 or, the file attribute is an implicit attribute. Automatically disable antivirus software.
Ctrl + Alt + Del Task Manager, look for sxs or SVOHOST in the process (not SVCHOST, one letter different) and end it if there is one (not all systems show that there is this process, and if there is no one, skip this step).
(Show hidden system files)
HKEY_LOCAL_MACHINESoftwareMicrosoftwindowsCurrentVersionexplorerAdvancedFolderHiddenSHOWALL, change the Checked key value to 1
Note here that the virus will delete the originally valid DWORD value Checked, create an invalid string value Checked, type REG_SZ, and change the key value to 0! It is useless for us to change this to 1. Everyone should see the type after Checked. The correct one is "RED_DWORD" instead of "REG_SZ" (some virus variants will delete this Checked directly, just like the one below, and rebuild it yourself)
Method: Delete this Checked key value, right-click Create - name it Checked, and then modify its key value to 1, so that you can select "Show all hidden files" and "Show system files".
(Delete the virus autostart item) Open the registry and run it-regedit
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
or
Find SoundMam (note that it is not soundman, only one letter is missing) key value, there may be two, delete the key value of C:\
Then:
Delete the BAT of each disk virus file
Save the following code as bat
cd
c:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
D:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
E:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
F:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f
G:
attrib -a -h -s
del /s /q /f
attrib -a -h -s
del /s /q /f