This machine is infected with files important data automatic backup exe , how to delete it.

Choosing to inhibit regeneration --- this is a palliative solution.

2.In this case, it seems that a program must be automatically regenerating these files, just deleting them is useless, he changes the file name, and your work is in vain (for example: automatic data backup.

The fact that Security Guard and Kaspersky can't find it doesn't necessarily mean that there is no virus, it may be that the software has already been attacked by the virus.

5.Remember to update the virus database before using all kinds of antivirus and anti-Trojan software.

It can be solved, but it has to be checked and killed many times

If you can't kill it, don't divide it! ~~

In the first step, first click on the program in the start, go to Run, type regedit, and you will be taken to a registry.

The second step is to find the second main menu in the left column of the registry, user.

Search for software, and find microsof in the submenu - windows - currentversion - explorer - mountpoint2, mountpoint2 This menu is the target.

The third step is to open all the subfiles of mountpoint2, that is, to open all the files with plus signs. Then click one by one, and delete all the files that start with auto. If you see a file with the auto icon in the right column, delete it as well.

At the same time as clicking, some files also have a submenu called shell, and this file also needs to be deleted.

In this way, the process of clarifying auto is complete and you can shut down the operation.

You don't understand the essence of how the program works.

After the program runs, a process will be formed, as for the file, it is only its previous carrier, and some programs can even delete the original file after running (the general program will say that it is in use).

Therefore, if you just delete these virus files, it is natural for the virus process to be recovered.

Since all folders and files can be displayed, I initially don't think it's a very powerful virus.

More than 95% of the tricks in the registry are done, because if it wants to achieve boot auto-start, you can use this startup item viewer to clear its auto-start, but this is the final sweep.

The first thing that should be done is to clean up the process, because in this way the virus will be terminated and thus prevent its recurrence.

To check the process, you need to look not only at the name of the process, but also at the path of the file.

If you're lucky, you'll have a backup of your important data. exe process, in addition, there should be at least one other virus process, find out and hold the ctrl checkmark and end it together.

If you think it is difficult to troubleshoot the process, you can get a screenshot for me, and I will help you analyze it.

Then there is the cleaning of the files, also with the ice blade, because if you double-click the disk directly, the virus file in the root directory will be triggered, causing the virus to run again.

Then there is the cleanup of the registry, first clean up the ifeo hijacking key, hklm-software-microsoft-windowsnt- just one, and all the children with debugger in the entries abbreviated as ifeo must be deleted, except for a default child that starts with your. Observe the value when deleting, which should be the path of the virus elsewhere. If you encounter difficulties in troubleshooting, you can find them here.

After that, use the startup item to find out the virus and delete it with the registry management function of Ice Blade.

If it is in the startup directory, use the file management function to delete it.

That's probably it, send me a message if you don't understand.

Except for the path of IFEO, which is pasted from the previous one, everything else is freshly beaten, so tired.

Good luck with the antivirus!

Open Notepad in the Start:

echo off

echo If you've already run this script or something like that, don't run pause

cd\attrib -s -a -r -hif exist (

echo found that there is, press any key to delete...

pause>nul

delmdcdmd nokill...

cd ..attrib +a +s +h +r

else (

echo No files found under this drive letter, press any key to continue...

pause>nul

mdcdmd nokill...

cd ..attrib +a +s +h +r

echo run is complete, press any key to exit...

pause>nul

When you save it, be careful and change the file name to or.

You can go after running.

Then change the above to Automatic backup of important data. exe

Save as or.

Try 360's antivirus software to kill it, or nod32 antivirus software can get rid of worms in you, it's not a big problem.

Top dog. It's a virus.

I don't know this... It's not a virus, how can it run all the plates?

If you think about it, you will know Karma.

Speed Antivirus.

Let's shred the file with it... Any antivirus software can generally be smashed, ignoring all viruses and forcibly deleting.

It should be a Trojan, and the file suffix of the automatic backup will generally not be an executable file.

It is recommended to scan the system disk with anti-virus software and check whether there are suspicious executable files and associated files hidden in the root directory of other drive letters.

If the file name is the one you said, it is basically a Trojan virus, and you can see if it can be deleted, and its associated files to manually determine whether it is a virus.

Jinshan Dry Poison Tyrant is more relevant to this virus. I've been poisoned like this before. Jinshan Poison Tyrant solves it directly. The next trial version. After killing the group, answer the poison and then unload it. Accounts for the system of capital or large source of ants. Not suitable for common use.

You can write a batch program that is suspicious of God.,You can copy the following ** to txt.,Blind Xiang and then change the suffix to bat.,It should be possible to change the exe under the current Qinzi's directory to ex,@echo off

pauseren *.exe *.ex

Yes, the folder is hidden. Do as I do, it should be able to recover :

win+r cmd attrib h: * s d -s -h -r Enter, pay attention to the spaces!

And then everything came out. I'm assuming your drive letter is h:.

You're welcome!!

Can't recover, you'd better.

1. Use the top game to kill the solid horse.

Yes, use data recovery software to recover the folder first, then unzip it, and then kill it.

Important data deleted, you can try data recovery software, baidu search has this kind of function, if these software can not be retrieved, the data is extremely important, it is recommended to go to **find a professional data recovery person, they can help you solve!

You can use the nero software, it's very convenient, you can take a look.