Five steps to manually remove hidden virus

After selecting the option “Show hidden files and folders”, you find that one file of the movable disk disappears right after flashing through the window. When re-click on the “Folder Options”, it still shows the option of “Do not show files and folder”. Moreover, when clicking on the disk icon of C or D, another unknown window pops up.

Symptom description:
1. Could not show hidden file

2. Another window pops up When clicking on the hard disk icon of C or D

3. By Viewing C or D disk with winrar, the files autorun.inf and tel.xls.exe are found under the directories

4. There is a weird “kill” in the applications of the Windows Task Manager

5. There is an odd SocksA.exe within the startup programs

Solution:

Please do not double-click on the hard disks during the following process. To open hard disk, please right-click on the icon and click Open.

Step one: end up virus process

Search for any unknown application similar to “Kill” in the task manager, and right-click on the application ->switch to process -> look for process similar to SVOHOST.exe, and right-click -> select End Process Tree.

Step two: show system file that was hided

Start -> enter “regedit” and navigate to HKEY_LOCAL_MACHINESoftware\Microsoft\Windows\Current\Version\explore\rAdvanced\Folder\Hidden\SHOWALL, delete the key of CheckedValue; right-click on the blank -> select New -> select DWORD value -> name the new key as “CheckedValue” and then double-click to modify its value as “1”. Then you can choose either “Do not show hidden files and folders” or “Show hidden files and folders” optionally.

Step three: remove virus

Right-click the hard disk -> open -> search and delete the two files autorun.inf and tel.xls.exe in every hard disks, including movable disk.

Step four: remove the auto-run files of virus

Start -> Run -> msconfig-> Startup -> delete items such as sacksa.exe、SocksA.exe; or open registry by entering “regedit”.

Navigate and delete the following registry key: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows> CurrentVersion>Run.
Search and delete items similar to C: WINDOWSsystem32SVOHOST.exe

Step five: delete the leftover files

Delete SVOHOST.exe(please note that Windows system also has a similar file), session.exe、sacaka.exe、SocksA.exe and all files which icons are similar to excel, under the directories of C：WINDOWS and C：WINDOWSsystem32.

Finally, restart your PC to finish.