China DOS Union

Just now changed to WIN XP SP2, and everything else is fine after installation. It's a pity that every time I start the computer, a blank Notepad will automatically open. It's quite troublesome to close it each time, and I don't know how to make it stop automatically opening this blank Notepad file.

Haven't seen it. Just cancel it in the startup items!

Infected, it seems there is a file like wincfg in the system32 directory. Just delete it and remove the run in the registry. This kind of virus has no daemon process, so it's easy to delete manually.

I've cleared it. I've cleared many related files in the registry, but I can't find that file in system32. It still appears. Really depressed.

It must be infected with a trojan horse. Delete wincfg under DOS.

Didn't find the wincfg.exe file in the system32 directory, how to delete it?

The building owner should pay special attention to the following key value in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"

See if it has already become:
"shell"="Explorer.exe notepad.exe"

I also encountered a similar situation! Thank you everyone!

Viruses are not difficult to solve and can be manually deleted.
1. End wincfgs in the process.
2. Use hijackthis or sreng to uncheck the relevant items in startup. It seems that msconfig can also be used, but I can't remember clearly.
3. Find wincfgs in the system32 directory. Note that when searching, hidden and system files should be included, then delete it.
4. Restart, and it should be okay.
Many viruses can be solved with the above steps.
Just some processes need to be ended with IceSword.

It may be that the file is set to hidden and system attributes, and many trojans are like this. Click Tools - Folder Options - View, select "Show all files" and do not select "Hide protected operating system files" to see all files.

Find all run 呵呵

It seems that you have a virus.

To achieve random execution, this virus modifies the registry to load and start with Windows Explorer. Also, did it modify the association of the txt suffix? There is no such item in the RUN startup.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="Explorer.exe"

Remove notepad.exe from the above key value, and then repair the file association. Find the associated program and delete it. Otherwise, the virus will be activated again.

3Q
Infected. Figured it out.

I also encountered a similar situation! Thank you everyone!