Description: Overall down, killing exe folder virus file, but you can not clear it in the c: \ F10S directory, the ctfmon.exe and the svchost.exe and it generates the Startup group shortcut. Due to constraints, I also spent days back surgery. It write your own handle to the key process winlogon. A UnLocker class in the source code, originally wanted cleared its handle to delete files, but are helpless of 0xC0000005 (STATUS_ACCESS_VIOLATION) of errors occurred. Finally, I am shameless abandon. Addition additional LPK killing. Basically it created the service, open process, injected threads, files can be killing. Source in SysService class. Services used to enumerate the system, unknown error occurred during the test. In desperation shameless abandon. Finally, use the CMD SC command to uninstall the service.
To Search:
File list (Check if you may need any files):
AntiRootKit\AntiRootkit\1.ico
...........\...........\1.jpg
...........\...........\11.jpg
...........\...........\AntiRootkit.csproj
...........\...........\bin\Debug\AntiRootkit.exe
...........\...........\...\.....\AntiRootkit.pdb
...........\...........\...\.....\AntiRootkit.vshost.exe
...........\...........\...\.....\AntiRootkit.vshost.exe.manifest
...........\...........\ErrorAddFunc.cs
...........\...........\FrmKillViru.cs
...........\...........\FrmKillViru.designer.cs
...........\...........\FrmKillViru.resx
...........\...........\FrmMain.cs
...........\...........\FrmMain.Designer.cs
...........\...........\FrmMain.resx
...........\...........\FrmModSearch.cs
...........\...........\FrmModSearch.Designer.cs
...........\...........\FrmModSearch.resx
...........\...........\KillVirus\FrmKillViru.cs
...........\...........\.........\FrmKillViru.Designer.cs
...........\...........\.........\FrmKillViru.resx
...........\...........\ModInfo.cs
...........\...........\obj\x86\Debug\AntiRootkit.csproj.FileListAbsolute.txt
...........\...........\...\...\.....\AntiRootkit.exe
...........\...........\...\...\.....\AntiRootkit.FrmKillViru.resources
...........\...........\...\...\.....\AntiRootkit.FrmMain.resources
...........\...........\...\...\.....\AntiRootkit.FrmModSearch.resources
...........\...........\...\...\.....\AntiRootkit.pdb
...........\...........\...\...\.....\AntiRootkit.Properties.Resources.resources
...........\...........\...\...\.....\DesignTimeResolveAssemblyReferencesInput.cache
...........\...........\...\...\.....\GenerateResource.read.1.tlog
...........\...........\...\...\.....\GenerateResource.write.1.tlog
...........\...........\Privilege.cs
...........\...........\ProcFunc.cs
...........\...........\ProcInfo.cs
...........\...........\Program.cs
...........\...........\...perties\AssemblyInfo.cs
...........\...........\..........\Resources.Designer.cs
...........\...........\..........\Resources.resx
...........\...........\..........\Settings.Designer.cs
...........\...........\..........\Settings.settings
...........\...........\SysServices.cs
...........\...........\UnLocker.cs
...........\AntiRootkit.exe
...........\AntiRootkit.sln
...........\AntiRootkit.suo
...........\Data\exe.rar
...........\....\exeData.txt
...........\....\exeReport.htm
...........\....\hrl41.rar
...........\....\InjectTest.dll
...........\....\lpk.rar
...........\....\lpk.txt
...........\....\LpkReport.htm
...........\....\lpksvr.txt
...........\....\rizrio.rar
...........\lpk.dll
...........\usp10.dll
...........\说明.txt
...........\这里的两个LPK.DLL USP10.DLL 是系统文件 防感染的.txt
...........\AntiRootkit\obj\x86\Debug\TempPE
...........\...........\...\...\Debug
...........\...........\bin\Debug
...........\...........\...\Release
...........\...........\obj\x86
...........\...........\bin
...........\...........\KillVirus
...........\...........\obj
...........\...........\Properties
...........\AntiRootkit
...........\Data
AntiRootKit
Download