感染了W32.SillyFDC和Trojan Horse病毒

Question

解決方法雖然我已試過（和那發問者狀況完全一樣）
→　http://tw.knowledge.yahoo.com/question/?qid=1607020210898

但是在幾個部份還是不懂：

［先在執行的地方打上gpedit.msc］→　電腦說找不到　但打regedit　　　　　　　　　　　　　　　　　就ｏｋ

［出現群組原則後在>電腦設定>］→電腦設定在哪？

去按刪除時（雖然是不行的）它說：請確定磁碟仍有可用空間且不是寫入保護以及
［該檔案目前不在使用中］→是只會ㄧ直毒下去嗎？　如果不刪除的話

另外一個　我每次用ＭＰ３時　總會出現＂發現病毒＂
檔名是 F:\antorun.inf 病毒名稱為 Trojan Horse
這個的刪除辦法是?

Answer 1

W32.SillyFDC：如合作系統備份連結：How to make a backup of the Windows registry.
手動刪除法：

Click Start > Run.
Typeregedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


In the right pane, delete the value associated with the virus.


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders


In the right pane, delete the value associated with the virus.


Exit the Registry Editor.
Trojan Horse
Click Start > Run.
Typeregedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.


Navigate to the subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrenVersion\RunServicesOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run



In the right pane, delete any value that refers to a file that was detected during the scan.


Exit the Registry Editor.