Although it has been poisoned, Kaspersky can only report poisoning in a row and continuously for this process and file, and then report the anti-virus successfully. One needs to be restarted and deleted.
After closing the suspicious process in msconfig startup, restarting Kaspersky prompts still! Observe the runs that the process can still see. After the process is finished, it starts again, and Kaspersky prompts still!
Find the file in Windows system32, use unlocker to delete it, and restart the computer according to the prompt. After booting again, the prompt pops up saying that Windows cannot find the file "", please make sure the file name is correct, try it once and so on. This time, this virus can no longer be found with Kaspersky, and the poison clearance is successful!
You cannot search in the registry, and the words cannot be found in the ini and inf files installed in the system.
Under the registry [Enter regedit at run to enter the registry]
HKEY_LOCAL_MACHINE\Software\Microsoft\windowsNT\currentVersion\winlogon
A child named shell was found to change Shell"=" - "data, and change Shell"=" - " to "Shell"="". Everything is OK!
When you do not use Unlocker to delete, you can choose another solution:
The process cannot end even in safe mode. You can enable safe mode with command line after restarting and use the DOS command to delete the del command in a centralized manner, that is, del c:\windows\system32\ If it is not successful, you can use: attrib c:\windows\system32\ -h First remove its hidden attributes. Then execute the delete command.
After closing the suspicious process in msconfig startup, restarting Kaspersky prompts still! Observe the runs that the process can still see. After the process is finished, it starts again, and Kaspersky prompts still!
Find the file in Windows system32, use unlocker to delete it, and restart the computer according to the prompt. After booting again, the prompt pops up saying that Windows cannot find the file "", please make sure the file name is correct, try it once and so on. This time, this virus can no longer be found with Kaspersky, and the poison clearance is successful!
You cannot search in the registry, and the words cannot be found in the ini and inf files installed in the system.
Under the registry [Enter regedit at run to enter the registry]
HKEY_LOCAL_MACHINE\Software\Microsoft\windowsNT\currentVersion\winlogon
A child named shell was found to change Shell"=" - "data, and change Shell"=" - " to "Shell"="". Everything is OK!
When you do not use Unlocker to delete, you can choose another solution:
The process cannot end even in safe mode. You can enable safe mode with command line after restarting and use the DOS command to delete the del command in a centralized manner, that is, del c:\windows\system32\ If it is not successful, you can use: attrib c:\windows\system32\ -h First remove its hidden attributes. Then execute the delete command.