A rookie question about the virus, please give me a lot of advice50

If you don't open the USB drive, it shouldn't have infected the system, because the virus doesn't have a chance to run, don't worry too much! The virus in the quarantine area can't run, Norton is isolated, only Norton is there, it's fine, and then the computer will have to kill the new mobile devices such as USB disks and CDs!

1. There are more and two processes, in which the process is the same as the process name of the system, and two more startup projects are found to be viewed with msconfig, in"c:\windows\system32"Two files appear below: and both are hidden files).

2. It cannot operate normally Haofang, Frozen Throne and other software.

Workaround:—Insert the infected USB flash drive or *** (if any).

Press"ctrl+alt+del"Bring up Windows Task Manager and end the process, where there are two processes, one is the system and the other is the virus, and the location of the system is"C: Windows", where the virus is located"c:\windows\system32", just end the process of the virus.

If you can't distinguish between the two processes, you can end both processes and then switch to - Application - New Task - Browse - Select"c:\windows"folder, and then open it, OK, and you can restart the process of the system.

End the process.

Open"My computer"-- Tools -- Folder Options -- View -- Uncheck the box in front of "Hide protected OS files", press "Yes" in the pop-up dialog box, and then select "Show all files and folders" -- OK.

Enter the U disk or *** (if any),Delete all three files,When you delete it, it will pop up a dialog box that is"System Files",Don't care,Just press "Yes" to delete it (if you don't delete it,The computer will be reinfected the next time you use it)

Enter"c:\windows\system32"- Delete the two files in the folder.

Follow the steps in step 4 to reverse the process and re-hide the system files.

Start - Run - Enter regedit, press OK to open the registry, enter the hkey current user software Microsoft Windows CurrentVersion Run directory, right-click to delete and two records. Go to hkey local machine software microsoft windows nt currentversion winlogon, you can see the key-value item userinit, its value is ,, double-click userinit to delete the comma in the middle and delete - OK.

Restart your computer, and you're done!

If the process doesn't start or the registry doesn't have these entries, you can simply delete the virus file.