With the limited time the popularity of broadband, for the convenience of BT download, a lot of friends love the 24-hour hang. The round-the-clock on-line, which for a number of viruses, Trojan horse "invasion" of the system has brought great convenience, in the middle of the night they invaded our computers, all kinds of evil things deliberately. I said in the past to help a friend Anti-Virus, on the face of a "can not remove the virus", following the killing of experience to share with you.
1. Jingxian virus. A friend's computer to install the Windows XP Professional Edition, recently often through the night with the boot BT download movies, did not expect at a boot time, Norton virus found in the next report on the "exporer.exe", but the use of Norton scan, although the virus can be found However, Norton can not be prompted to isolate and remove the virus files.

2. Killing. In general, if the virus can not be directly deleted, mostly because of the virus in the process leading to the run to open the Task Manager, find the process of the virus "exporer.exe" to the successful termination, in accordance with the provision of Norton virus path of the file, the virus found documents , Hold down the Shift key to select right-click the "delete" It is strange that the system has not prompted to delete files, open the Task Manager again, I have been convinced that the process of termination of the virus, but is not written in the protection of the state, why can not delete? Me Trying to delete a folder, but the same system was rejected several times to restart the computer remains the same result.

Later in my view "exporer.exe" attributes (look at the document said formation and size of the period, in order to search his associates did not have the virus), attributes the accident found that a window of "security" tab, click the user can see A list of rights "special rights" to refuse the option was marked wilsonii, the document will not lead to competence can not be removed? Click the "Advanced" button in the pop-up window, I saw a "refusal to delete" authority, Click the "edit" at last to see deleted files can not be the real reason for the original permission to delete the current user facilities were set up for the drug turned down, but it allowed "to read and run, refused to cancel the authority, the return of file attributes window , Check "to allow full control", click "OK" after successfully deleted from the "exporer.exe".

Tips

Files (folder) attributes the "security" label only in the NTFS format partition, If you do not see the label, open My Computer, click "Tools ? Options ? folder view", and then in the Advanced Settings option Under the removal of "simple file sharing (Recommended)" before the wilsonii.

I deleted the "exporer.exe" after trying to delete a folder, the system was rejected by the folder to view the "security" attributes, can be found in the same authority to remove (delete files and subfolders, and delete) have been rejected, ibid , To remove the restrictions on smoothly after the virus "swept aside to benefit." The document (folder), if as a result of the reasons was refused permission to operate, the general authority will be set to "complete control" can be.

Tips

(1) rights can be inherited, sometimes to open a file security attributes label, in Figure 4 may not have "refused to delete" authority, but if it's the parent folder set up, "refused to delete files and subfolders "This document can not be removed, a solution is to file permissions set to full control.

(2) file permissions and the file owner is associated, for the Office of the multi-computer accounts, some people with ulterior motives may correspond to the user and the Trojans will be up (for computer operation so as to lower the level of accounts, vigilance not easy to steal information ), If the horse was found drugs and associated with the corresponding account, that is, some users log on after the horse will run, while others do not (Trojan file permissions set to read and delete the prohibited), this system can be logged on as an administrator, Horse owners will be forced to change the document for the current user, and then set to full control of the horse will be deleted.

(3) a little experience. Windows XP/2000 documents (folder) permission, the system is a special feature that allows flexibility to set different permissions for different users, a number of horses who passed the virus program file is set to be allowed "to read and run" and refused "to remove "In order to better achieve the" self-protection. " As the file permissions to change the operation of complex facilities are generally poison to host hands-on, the favorite hang-weather friend to install a good firewall protection, shut down unnecessary ports, and can effectively prevent the recurrence of such virus The attack, if the virus can not be removed in the process of termination of the case, we must look at whether the file permissions have been changed.