Msl short message file

First of all, please set the system to "show hidden files" first, because the virus is disguised as a hidden attribute, without this setting, it will not be visible. The setting method is as follows (you can skip this step if the system has already completed this setting):

Open "My Computer";

Open menu tools/folder options in turn;

Then switch to the viewing page in the pop-up folder options dialog box;

Remove the check mark in front of "Hide protected operating system files (recommended)" and leave it unchecked;

Change the option "Do not show hidden files and folders" in the list box of "Advanced Settings" below to the option "Show all files and folders";

Remove the check mark in front of "Hide extensions of known file types" and leave it unchecked;

Finally, click OK.

2. Open Start/Run, enter "regedit", then enter "OK" to open the Registry Editor, enter HKEY _ local _ machine \ software \ Microsoft \ Windows \ current version \ run item, and find the item named ""; The value of "Rundll", if found, please double-click to open it, check and write down the file and path name indicated in "Numerical Data", and its format is generally "C:\WINNT\System32\XXXX.exe" (but it is not fixed, depending on the specific environment). Note that "XXXX.exe" stands for any value, not a fixed value, not 4. Rundll "value;

Third, press "Ctrl+Alt+Del" to pop up the task manager and find the process of "XXXX.exe" recorded in the second step above (note that the XXXX.exe here is a specific name, not four X's). When the same process is found, select it and click "End Process" to end the Trojan process;

4. Open the Explorer and enter "system directory \Winnt\System32" (if your win2000/nt/xp is installed on drive C, enter C:\Winnt\System32). Find the files of XXXX.exe and XXXX.dll and delete them directly (of course, XXXX here still represents not four X's, but specific names); If you find that XXXX.dll can't be deleted during the deletion process, but report "File can't be deleted in use", you can log off or restart your computer, and then find and delete it by this method.

At this point, if all goes well, you should be able to get rid of this Trojan horse.

If there is no dll file under PS: RUN, just delete the virus name displayed by Jinshan, and I will follow the above operation for the rest.