Popular QQ Trojan tail and hand- killing method

QQ Thieves ,Lacoste Swerve Keyline Shoes
symptoms
embedded 1 and began to run automatically.
1,Womens Lacoste Observe Shoes, the Trojan runs, it will generate in the system folder:% SystemDir% NTdhcp.exe, 28400 bytes.
and increase the registry key:
[HKEY_LOCALMACHINE Software Microsoft Windows CurrentVersion Run]
can be run automatically.
2,Lacoste Shua Lace Shoes,
clear:
premier escape Task Manager, ascertain and end the process
out NTdhcp.exe virus file in consensus with the situation of System NTdhcp.exe find the virus file system directory, manually deleted. Run REGEDIT Registry Editor, sail to
[HKEY_LOCALMACHINE Software Microsoft Windows CurrentVersion Run], following the RUN key


1 floor nightmare to work incognito - 06 19 - 17:16
QQ automatically sent some of the names tin be seductive executable file (the icon is an icon archive)
open the Task Manager to end off RUNDLL32.EXE and TIMP1atform.exe (Note that the number 1).
then let Windows show hidden files, find and delete the following files:
% System% . exe
% System% notepad.exe
% Windir% System RUNDLL32. EXE
QQ directory TIMP1atform.exe (note the number 1 not the letter l, not deleting the wrong)
then open the Registry Editor to remove:
HKEY_LOCAL_MACHINE Software Classes MSipv and HKEY_CURRENT_USER Software Classes MSipv under MainSetup,Lacoste Casual Shoes, MainUp, MainVer three DWORD opener.
last through the registry repair tool to repair EXE and TXT files associated with restart. QQ automatically sent some of the baiting appoint of the executable document (the icon namely one icon archive)
open the Task Manager apt end off RUNDLL32.EXE and TIMP1atform.exe (Note namely the number 1).
then let Windows show secret files,Lacoste R75 P2 Shoes, find and delete the emulating files:
% System% . exe
% System% notepad.exe
% Windir% System RUNDLL32. EXE
QQ directory TIMP1atform.exe (note the number 1 not the letter l, not deleting the erroneous)
then open the Registry Editor to remove:
HKEY_LOCAL_MACHINE Software Classes MSipv and HKEY_CURRENT_USER Software Classes MSipv under MainSetup, MainUp,Lacoste Prep CB Shoes, MainVer three DWORD key.
last through the registry fix tool to repair EXE and TXT files related with restart.