ipilrws.exe和ipilrws.exe病毒清除方法

1.建立a.bat 文件，内容如下

taskkill /f /im ipilrws.exe
taskkill /f /im ipilrws.exe
保存后运行（关闭病毒运行的程序）

2.打开winRAR

浏览每个盘符根目录。删除

x:\nqecmus.exe
x:\autorun.inf
3.打开注册表

删除HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run下的对应文件

 

病毒修改键值，使“显示隐藏文件”失效
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Type
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
改回来

5，添加注册表的启动项

到这病毒就不发作了，但是文件还在

C:\Program Files\Common Files\System\egrrgdk.inf
C:\Program Files\Common Files\System\ipilrws.exe
C:\Program Files\Common Files\System\owupxei.exe

删掉。还有些

c:\VBurl.exe
C:\Documents and Settings\Administrator\Local Settings\Temp\2222.exe
C:\Program Files\bhpkndi.inf
C:\Program Files\dld.dat
C:\Program Files\meex.exe
C:\Program Files\1a1221.exe
C:\Program Files\Common Files\Microsoft Shared\egrrgdk.inf
C:\Program Files\Common Files\Microsoft Shared\iqwfobe.exe
C:\Program Files\Common Files\Microsoft Shared\lnnvkiq.exe
C:\Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\atmQQ2.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGwd.dll
C:\Program Files\Common Files\Microsoft Shared\MSInfo\SysWFGwd2.dll
C:\Program Files\Common Files\System\egrrgdk.inf
C:\Program Files\Common Files\System\ipilrws.exe
C:\Program Files\Common Files\System\owupxei.exe
C:\WINDOWS\Fonts\rarjfni.dll
C:\WINDOWS\Fonts\rarjfpi.dll
C:\WINDOWS\Fonts\rarjftl.exe
C:\WINDOWS\Fonts\verclsids.exe

都删了。

ok