Rookie Classroom: Clean up the dll Trojan with the system permissions

I believe everyone is very familiar with the Dll Trojan. It is really very tempting to hate guys. Unlike ordinary exe trojans, which are easy to identify and clean, this guy is very concealed. It can be embedded in normal processes such as rundll32.exe, svchost.exe, etc., so that you can't find it, even if it is found, it is difficult to remove, because The normal process is calling it.
I use McAfee anti-virus software, for example, it reports now:

defds.dll: C:\\...\\Temp\\defds.dll deletion failed

fdgeg. Com: C:\\Windows\\ime\\fdgeg.com delete failed

Then you can know that defds.dll should be a dll Trojan. We can use the ice blade icesword to view the system process and find the process that calls the dll file, such as notepad.exe. We can try to terminate the process first, if the process does not take long before it is re-run (and I did not run Notepad), then we can determine that fdgeg.com is the daemon of notepad.exe. When it finds that the notepad.exe process it monitors is terminated, it will immediately re-enable notepad.exe.

Now we can: My Computer -> Tools -> Folder Options -> View, in the advanced settings option, the "Simple File Sharing" hook is removed (My computer is XP operating system) , NTFS disk format).

Then find fdgeg.com under C:\\Windo0ws\\ime, right-click on the property, select "Security" in the properties, click "Advanced", and make "Inherit those from the parent" in the pop-up window. Permission items that can be applied to child objects, including those explicitly defined here, are not selected, click Delete in the pop-up window, and then click OK. This way no user can make fdgeg.com work.

Terminate notepad.exe with icesword. Then delete defds.dll in C:\\Documents and Settings\\Administrator\\Local Settings\\ Temp. Then go to C:\\Windows\\ime and find fdgeg.com, right-click the property, select "Security" in the properties, click "Advanced", in the pop-up window, select "Inherit from the parent to those that can be applied to the child object. Permission items, including those explicitly defined here, and then delete it.

Finally, don't forget to delete this dll Trojan in the startup of the registry.

In this way, we completely removed this nasty dll Trojan from our computer.