多谢lanyu！病毒找到了，还有问题请教

来源: oldclock 于 2012-03-11 17:11:42 [] [旧帖] [给我悄悄话] 阅读数 : (1456 bytes)
回答: step by step 由 lanyu 于 2012-03-11 10:44:49 
在Documents and Settings%[UserName]Local SettingsApplication Data[random].exe里叫一个j打头的文件隐藏着，已经消除了。
还想请教一下(3) Remove the related registry entries of Security Shield 2012:
下面有些找不到，此外
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "RunInvalidSignatures" = 0x00000000结尾不是= 1，需要消掉吗？

下面的几条没有找到，一定要找到去处吗？
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerPhishingFilter "Enabled" = 0
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = .exe
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "[random].exe"

现在再找Malwarebyte，准备再查查毒。再次感谢！

HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerDownload "RunInvalidSignatures" = 1
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerPhishingFilter "Enabled" = 0
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "ProxyOverride" = " "
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "ProxyServer" =127.0.0.1:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet Settings "ProxyEnable" = 1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesAssociations "LowRiskFileTypes" = .exe
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun "[random].exe"

(4) Scan your computer by "Malwarebyte"
请您先登陆，再发跟帖！