Trojan.Win64.VICERCON.H

2025年3月25日

分析者: Leidryn Saludez

Trojan:Win32/DefenseEvasion!rfn (MICROSOFT)

平台:

Windows

总体风险等级:

潜在破坏:

潜在分布:

感染次数:

信息暴露:

恶意软件类型:
Trojan
有破坏性？:
没有
加密？:
没有
In the Wild:
是的

概要

感染途徑: 从互联网下载、由其他恶意软件释放

该木马通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

技术详细信息

文件大小: 2,750,464 bytes

报告日期: EXE

内存驻留: 是的

初始樣本接收日期: 2021年6月26日

Payload: 收集系统信息, 连接URL/IP地址，窃取信息

Arrival Details

该木马通过两种途径进入系统：一是被其他恶意软件作为文件释放到系统中，二是用户访问恶意网站时在不知情的情况下下载的文件。

Installation

该木马程序会释放以下文件：

%System%\{filename} ← malware copy with different hash
%Windows%\SysWow64\{filename} ← malware copy with different hash

(Note: %System% 是Windows系统文件夹,通常位于此路径 C:\Windows\System32 适用于所有Windows操作系统版本。 %Windows% 是Windows文件夹, 通常位于此路径 C:\Windows 适用于所有Windows操作系统版本。）

它会创建以下文件夹：

%Windows%\Fonts\
%Windows%\Fonts\clientdb\
%Windows%\Fonts\clientdb\ds\
%Windows%\Fonts\clientdb\gt\
%Windows%\Fonts\clientdb\MSBuild\
%System%\wostmp\
%Windows%\SysWow64\wostmp\

(Note: %Windows% 是Windows文件夹, 通常位于此路径 C:\Windows 适用于所有Windows操作系统版本。 %System% 是Windows系统文件夹,通常位于此路径 C:\Windows\System32 适用于所有Windows操作系统版本。）

其他系统修改

该木马会添加以下注册表项：

HKEY_CLASSES_ROOT\SHTinfo
sha1 = {malware defined values}

HKEY_CLASSES_ROOT\SHTinfo
notice = {malware defined values}

HKEY_CLASSES_ROOT\SHTinfo
tunnel = {malware defined values}

HKEY_CLASSES_ROOT\SHTinfo
peer = {malware defined values}

HKEY_CLASSES_ROOT\SHTinfo
staticpeer = {malware defined values}

HKEY_CLASSES_ROOT\SHTinfo
intranet = {hexadecimal values}

HKEY_CLASSES_ROOT\SHTinfo
comment = {hexadecimal values}

HKEY_CLASSES_ROOT\SHTinfo
forward = {hexadecimal values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
sha1 = {malware defined values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
notice = {malware defined values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
tunnel = {malware defined values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
peer = {malware defined values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
staticpeer = {malware defined values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
intranet = {hexadecimal values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
comment = {hexadecimal values}

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\
SHTinfo
forward = {hexadecimal values}

Information Theft

该木马程序会收集以下数据：

Computer Name
CPU information
Username
IP Address

其他信息

该木马程序会执行以下操作：

It moves its own file to:
- %System%\wostmp\{malware defined values}
- %Windows%\SysWow64\wostmp\{malware defined values}
It uses the following uncommon ports:
- 27930
It searches and gathers data from the following files:
- C:\1f.txt
- C:\1i.txt
- C:\1p.txt
- D:\1f.txt
- D:\1i.txt
- D:\1p.txt
- E:\1f.txt
- E:\1i.txt
- E:\1p.txt
- %Windows%\1f.txt
- %Windows%\1i.txt
- %Windows%\1p.txt
It checks the content of its added registries entries.
It sends UDP packets to any of the following IP addresses within the network range:
- {BLOCKED}.{BLOCKED}.248.1 up to {BLOCKED}.{BLOCKED}.248.255
- {BLOCKED}.{BLOCKED}.39.1 up to {BLOCKED}.{BLOCKED}.39.255
- {BLOCKED}.{BLOCKED}.246.1 up to {BLOCKED}.{BLOCKED}.246.255
- {BLOCKED}.{BLOCKED}.4.1 up to (BLOCKED}.{BLOCKED}.4.255
- {BLOCKED}.{BLOCKED}.37.1 up to {BLOCKED}.{BLOCKED}.37.255
- {BLOCKED}.{BLOCKED}.202.1 up to {BLOCKED}.{BLOCKED}.202.255
- {BLOCKED}.{BLOCKED}.93.1 up to {BLOCKED}.{BLOCKED}.93.255
- {BLOCKED}.{BLOCKED}.186.1 up to {BLOCKED}.{BLOCKED}.{BLOCKED}.255
- {BLOCKED}.{BLOCKED}.81.1 up to {BLOCKED}.{BLOCKED}.81.255
- {BLOCKED}.{BLOCKED}.21.1 up to {BLOCKED}.{BLOCKED}.21.255
- {BLOCKED}.{BLOCKED}.39.1 up to {BLOCKED}.{BLOCKED}.39.255
- {BLOCKED}.{BLOCKED}.73.1 up to {BLOCKED}.{BLOCKED}.73.255
- {BLOCKED}.{BLOCKED}.109.1 up to {BLOCKED}.{BLOCKED}.109.255
- {BLOCKED}.{BLOCKED}.30.1 up to {BLOCKED}.{BLOCKED}.30.255
- {BLOCKED}.{BLOCKED}.201.1 up to {BLOCKED}.{BLOCKED}.201.255
- {BLOCKED}.{BLOCKED}.6.1 up to {BLOCKED}.{BLOCKED}.6.255
- {BLOCKED}.{BLOCKED}.27.1 up to {BLOCKED}.{BLOCKED}.27.255
- {BLOCKED}.{BLOCKED}.198.1 up to {BLOCKED}.{BLOCKED}.198.255
- {BLOCKED}.{BLOCKED}.137.1 up to {BLOCKED}.{BLOCKED}.137.255
- {BLOCKED}.{BLOCKED}.139.1 up to {BLOCKED}.{BLOCKED}.139.255
- {BLOCKED}.{BLOCKED}.184.1 up to {BLOCKED}.{BLOCKED}.184.255
- {BLOCKED}.{BLOCKED}.203.1 up to {BLOCKED}.{BLOCKED}.203.255
- {BLOCKED}.{BLOCKED}.17.1 up to {BLOCKED}.{BLOCKED}.17.255
- {BLOCKED}.{BLOCKED}.128.1 up to {BLOCKED}.{BLOCKED}.128.255
- {BLOCKED}.{BLOCKED}.100.1 up to {BLOCKED}.{BLOCKED}.100.255
- {BLOCKED}.{BLOCKED}.231.1 up to {BLOCKED}.{BLOCKED}.231.255
- {BLOCKED}.{BLOCKED}.51.1 up to {BLOCKED}.{BLOCKED}.51.255
- {BLOCKED}.{BLOCKED}.15.1 up to {BLOCKED}.{BLOCKED}.15.255
- {BLOCKED}.{BLOCKED}.166.1 up to {BLOCKED}.{BLOCKED}.166.255
- {BLOCKED}.{BLOCKED}.1.1 up to {BLOCKED}.{BLOCKED}.1.255
- {BLOCKED}.{BLOCKED}.145.1 up to {BLOCKED}.{BLOCKED}.145.255
- {BLOCKED}.{BLOCKED}.33.1 up to {BLOCKED}.{BLOCKED}.33.255
- {BLOCKED}.{BLOCKED}.83.1 up to {BLOCKED}.{BLOCKED}.83.255
- {BLOCKED}.{BLOCKED}.123.1 up to {BLOCKED}.{BLOCKED}.123.255
- {BLOCKED}.{BLOCKED}.58.1 up to {BLOCKED}.{BLOCKED}.58.255
- {BLOCKED}.{BLOCKED}.6.1 up to {BLOCKED}.{BLOCKED}.6.255
- {BLOCKED}.{BLOCKED}.213.1 up to {BLOCKED}.{BLOCKED}.213.255
- {BLOCKED}.{BLOCKED}.33.1 up to {BLOCKED}.{BLOCKED}.33.255
- {BLOCKED}.{BLOCKED}.168.1 up to {BLOCKED}.{BLOCKED}.168.255
- {BLOCKED}.{BLOCKED}.189.1 up to {BLOCKED}.{BLOCKED}.189.255
- {BLOCKED}.{BLOCKED}.189.1 up to {BLOCKED}.{BLOCKED}.189.255
- {BLOCKED}.{BLOCKED}.125.1 up to {BLOCKED}.{BLOCKED}.125.255
- {BLOCKED}.{BLOCKED}.121.1 up to {BLOCKED}.{BLOCKED}.121.255
- {BLOCKED}.{BLOCKED}.131.1 up to {BLOCKED}.{BLOCKED}.131.255
- {BLOCKED}.{BLOCKED}.194.1 up to {BLOCKED}.{BLOCKED}.194.255
- {BLOCKED}.{BLOCKED}.93.1 up to {BLOCKED}.{BLOCKED}.93.255
- {BLOCKED}.{BLOCKED}.112.1 up to {BLOCKED}.{BLOCKED}.112.255
- {BLOCKED}.{BLOCKED}.218.1 up to {BLOCKED}.{BLOCKED}.218.255
- {BLOCKED}.{BLOCKED}.152.1 up to {BLOCKED}.{BLOCKED}.152.255
- {BLOCKED}.{BLOCKED}.128.1 up to {BLOCKED}.{BLOCKED}.128.255
- {BLOCKED}.{BLOCKED}.235.1 up to {BLOCKED}.{BLOCKED}.235.255
- {BLOCKED}.{BLOCKED}.12.1 up to {BLOCKED}.{BLOCKED}.12.255
- {BLOCKED}.{BLOCKED}.0.1 up to {BLOCKED}.{BLOCKED}.0.255
- {BLOCKED}.{BLOCKED}.31.1 up to {BLOCKED}.{BLOCKED}.31.255
- {BLOCKED}.{BLOCKED}.56.1 up to {BLOCKED}.{BLOCKED}.56.255
- {BLOCKED}.{BLOCKED}.127.1 up to {BLOCKED}.{BLOCKED}.127.255
- {BLOCKED}.{BLOCKED}.34.1 up to {BLOCKED}.{BLOCKED}.34.255
- {BLOCKED}.{BLOCKED}.16.1 up to {BLOCKED}.{BLOCKED}.16.255
- {BLOCKED}.{BLOCKED}.168.1 up to {BLOCKED}.{BLOCKED}.168.255
- {BLOCKED}.{BLOCKED}.80.0 up to {BLOCKED}.{BLOCKED}.97.255
- {BLOCKED}.{BLOCKED}.5.0 up to {BLOCKED}.{BLOCKED}.15.255
- {BLOCKED}.{BLOCKED}.190.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.25.0 up to {BLOCKED}.{BLOCKED}.50.255
- {BLOCKED}.{BLOCKED}.1.0 up to {BLOCKED}.{BLOCKED}.25.255
- {BLOCKED}.{BLOCKED}.210.0 up to {BLOCKED}.{BLOCKED}.250.255
- {BLOCKED}.{BLOCKED}.1.0 up to {BLOCKED}.{BLOCKED}.26.255
- {BLOCKED}.{BLOCKED}.252.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.140.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.60.0 up to {BLOCKED}.{BLOCKED}.90.255
- {BLOCKED}.{BLOCKED}.90.0 up to {BLOCKED}.{BLOCKED}.115.255
- {BLOCKED}.{BLOCKED}.85.0 up to {BLOCKED}.{BLOCKED}.120.255
- {BLOCKED}.{BLOCKED}.60.0 up to {BLOCKED}.{BLOCKED}.85.255
- {BLOCKED}.{BLOCKED}.50.0 up to {BLOCKED}.{BLOCKED}.60.255
- {BLOCKED}.{BLOCKED}.140.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.150.0 up to {BLOCKED}.{BLOCKED}.175.255
- {BLOCKED}.{BLOCKED}.140.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.40.0 up to {BLOCKED}.{BLOCKED}.65.255
- {BLOCKED}.{BLOCKED}.185.0 up to {BLOCKED}.{BLOCKED}.210.255
- {BLOCKED}.{BLOCKED}.100.0 up to {BLOCKED}.{BLOCKED}.110.255
- {BLOCKED}.{BLOCKED}.230.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.200.0 up to {BLOCKED}.{BLOCKED}.225.255
- {BLOCKED}.{BLOCKED}.90.0 up to {BLOCKED}.{BLOCKED}.115.255
- {BLOCKED}.{BLOCKED}.185.0 up to {BLOCKED}.{BLOCKED}.200.255
- {BLOCKED}.{BLOCKED}.5.0 up to {BLOCKED}.{BLOCKED}.15.255
- {BLOCKED}.{BLOCKED}.120.0 up to {BLOCKED}.{BLOCKED}.150.255
- {BLOCKED}.{BLOCKED}.211.0 up to {BLOCKED}.{BLOCKED}.240.255
- {BLOCKED}.{BLOCKED}.85.0 up to {BLOCKED}.{BLOCKED}.100.255
- {BLOCKED}.{BLOCKED}.35.0 up to {BLOCKED}.{BLOCKED}.75.255
- {BLOCKED}.{BLOCKED}.50.0 up to {BLOCKED}.{BLOCKED}.60.255
- {BLOCKED}.{BLOCKED}.70.0 up to {BLOCKED}.{BLOCKED}.85.255
- {BLOCKED}.{BLOCKED}.20.0 up to {BLOCKED}.{BLOCKED}.38.255
- {BLOCKED}.{BLOCKED}.180.0 up to {BLOCKED}.{BLOCKED}.200.255
- {BLOCKED}.{BLOCKED}.140.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.90.0 up to {BLOCKED}.{BLOCKED}.110.255
- {BLOCKED}.{BLOCKED}.145.0 up to {BLOCKED}.{BLOCKED}.175.255
- {BLOCKED}.{BLOCKED}.220.0 up to {BLOCKED}.{BLOCKED}.220.255
- {BLOCKED}.{BLOCKED}.230.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.40.0 up to {BLOCKED}.{BLOCKED}.60.255
- {BLOCKED}.{BLOCKED}.185.0 up to {BLOCKED}.{BLOCKED}.200.255
- {BLOCKED}.{BLOCKED}.1.0 up to {BLOCKED}.{BLOCKED}.20.255
- {BLOCKED}.{BLOCKED}.65.0 up to {BLOCKED}.{BLOCKED}.75.255
- {BLOCKED}.{BLOCKED}.210.0 up to {BLOCKED}.{BLOCKED}.240.255
- {BLOCKED}.{BLOCKED}.75.0 up to {BLOCKED}.{BLOCKED}.90.255
- {BLOCKED}.{BLOCKED}.150.0 up to {BLOCKED}.{BLOCKED}.175.255
- {BLOCKED}.{BLOCKED}.1.0 up to {BLOCKED}.{BLOCKED}.15.255.
- {BLOCKED}.{BLOCKED}.145.0 up to {BLOCKED}.{BLOCKED}.160.255
- {BLOCKED}.{BLOCKED}.150.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.230.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.25.0 up to {BLOCKED}.{BLOCKED}.55.255
- {BLOCKED}.{BLOCKED}.50.0 up to {BLOCKED}.{BLOCKED}.80.255
- {BLOCKED}.{BLOCKED}.85.0 up to {BLOCKED}.{BLOCKED}.115.255
- {BLOCKED}.{BLOCKED}.10.0 up to {BLOCKED}.{BLOCKED}.30.255
- {BLOCKED}.{BLOCKED}.155.0 up to {BLOCKED}.{BLOCKED}.175.255
- {BLOCKED}.{BLOCKED}.165.0 up to {BLOCKED}.{BLOCKED}.185.255
- {BLOCKED}.{BLOCKED}.230.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.85.0 up to {BLOCKED}.{BLOCKED}.105.255
- {BLOCKED}.{BLOCKED}.110.0 up to {BLOCKED}.{BLOCKED}.130.255
- {BLOCKED}.{BLOCKED}.180.0 up to {BLOCKED}.{BLOCKED}.210.255
- {BLOCKED}.{BLOCKED}.155.0 up to {BLOCKED}.{BLOCKED}.180.255
- {BLOCKED}.{BLOCKED}.60.0 up to {BLOCKED}.{BLOCKED}.70.255
- {BLOCKED}.{BLOCKED}.155.0 up to {BLOCKED}.{BLOCKED}.180.255
- {BLOCKED}.{BLOCKED}.152.0 up to {BLOCKED}.{BLOCKED}.175.255
- {BLOCKED}.{BLOCKED}.130.0 up to {BLOCKED}.{BLOCKED}.165.255
- {BLOCKED}.{BLOCKED}.210.0 up to {BLOCKED}.{BLOCKED}.245.255
- {BLOCKED}.{BLOCKED}.220.0 up to {BLOCKED}.{BLOCKED}.255.255
- {BLOCKED}.{BLOCKED}.1.0 up to {BLOCKED}.{BLOCKED}.25.255
- {BLOCKED}.{BLOCKED}.170.0 up to {BLOCKED}.{BLOCKED}.180.255
- {BLOCKED}.{BLOCKED}.40.0 up to {BLOCKED}.{BLOCKED}.70.255
- {BLOCKED}.{BLOCKED}.45.0 up to {BLOCKED}.{BLOCKED}.65.255
- {BLOCKED}.{BLOCKED}.25.0 up to {BLOCKED}.{BLOCKED}.50.255
- {BLOCKED}.{BLOCKED}.190.0 up to {BLOCKED}.{BLOCKED}.200.255
- {first 3 octets of computer IP Address}:0 up to {first 3 octets of computer IP Address}:255
- {first 2 octets of computer IP Address}:0:0 up to {first 2 octets of computer IP Address}:255:255

解决方案

最小扫描引擎: 9.800

First VSAPI Pattern File: 20.102.03

VSAPI 第一样式发布日期: 2025年3月25日

VSAPI OPR样式版本: 20.103.00

VSAPI OPR样式发布日期: 2025年3月26日

Step 1

亚信安全测性机器学习可在恶意软件初现时、尚未在系统执行前便及时检测并拦截。启用此功能后，您的亚信安全产品会使用以下机器学习命名标识检测该恶意软件：

Troj.Win32.TRX.XXPE50FFF091

Step 2

在进行任何扫描之前，Windows 7、Windows 8、Windows 8.1 和 Windows 10 用户必须先执行以下操作：禁用 系统还原 以便对电脑进行全面扫描。

Step 3

注意：在此恶意软件/间谍软件/灰色软件执行期间，并非所有文件、文件夹和注册表键值和项都会安装到您的计算机上。这可能是由于不完整的安装或其他操作系统条件所致。如果您没有找到相同的文件/文件夹/注册表信息，请继续进行下一步操作。

Step 4

以安全模式重启

[ 更多 ]

请按以下步骤操作=

要进入安全模式重启：

• For Windows 7 and Windows Server 2008 (R2) users

重启你的电脑。
按下F8 在开机自检（POST）程序完成后。如果 高级启动选项 若未出现菜单，请尝试重启计算机，并在POST界面显示后多次按F8键。
在高级启动选项菜单中，使用方向键选择Safe Mode 选项，然后按 Enter.

• For Windows 8, Windows 8.1, and Windows Server 2012 users

访问Charms bar 将鼠标指针移至屏幕右上角即可。
将鼠标指针向下移动并点击 Settings>更改您的电脑设置.
在左侧面板中，点击“通用”。
在右侧面板中，向下滚动至底部找到 Advanced startup 部分，然后点击 Restart now 按钮并等待系统重启。
在Advanced Startup 菜单中，点击 Troubleshoot>Advanced Options>Startup Settings>Restart 并等待系统重启。
在Startup Settings 菜单中，按下 4 以启用安全模式。

• 对于 Windows 10 用户：

按下Windows logo key + I 键打开“设置”。若无效，请选择 Start按钮，然后选择Settings.
选择Update & Security > Recovery.
在Advanced startup, select Restart now.
当您的电脑重启进入 请选择一个选项 屏幕上，选择Troubleshoot > Advcanced options > 启动设置 > Restart.
电脑重启后，您将看到一系列选项。请选择4 或按 F4 以安全模式启动您的电脑。

Step 5

删除此注册表项

[ 更多 ]

Important: 编辑 Windows Registry 操作不当可能导致系统出现无法恢复的故障。请务必仅在您熟悉相关步骤的情况下执行；如有疑问，可寻求系统管理员的协助。否则，请查看下方链接。 Microsoft article 修改计算机注册表前请务必先进行此操作.

In HKEY_CLASSES_ROOT\SHTinfo
In HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SHTinfo

请按以下步骤操作=

要删除此恶意软件/灰色软件创建的注册表项：

打开注册表编辑器。
» 对于 Windows 7 和 Windows Server 2008 (R2) 用户，请点击 Start button, type regedit in the Search输入字段，然后按下Enter.
» 对于 Windows 8、Windows 8.1、Windows 10 和 Windows Server 2012 (R2) 用户，请右键点击屏幕左下角,点击Run, type regedit 在提供的文本框中，然后点击 Enter.
在左侧面板中，双击以下项目：
HKEY_CLASSES_ROOT>SHTinfo
仍在左侧面板中，找到并删除以下注册表项：
HKEY_LOCAL_MACHINE>SOFTWARE>Classes>SHTinfo
关闭注册表编辑器。

Step 6

禁用该恶意软件服务

[ 更多 ]

{9 random characters}

请按以下步骤操作=

正在禁用恶意软件服务

要禁用某项服务：

打开命令提示符窗口：
» 对于 Windows 7 和 Windows 2008 (R2) 用户，请点击 Start button, type cmd in the Search input field, and press Enter.
» 对于 Windows 8、Windows 8.1 及 Windows Server 2012 (R2) 用户，请右键单击屏幕左下角,点击命令提示符.
» 对于 Windows 10 用户：, 右键单击 屏幕左下角,click Run, type cmd 在提供的文本框中输入，然后按 Enter.
在命令提示符处，输入以下内容：
NET STOP {9 random characters}
按Enter键。应会显示一条消息，表明服务已成功停止。
关闭命令提示符窗口。

Step 7

搜索并删除此文件夹

[ 更多 ]

请确保勾选搜索隐藏文件和文件夹;/i>选项复选框（位于“更多高级选项”中），以便将全部隐藏文件夹纳入搜索结果。
%Windows%\Fonts\
%Windows%\Fonts\clientdb\
%Windows%\Fonts\clientdb\ds\
%Windows%\Fonts\clientdb\gt\
%Windows%\Fonts\clientdb\MSBuild\
%System%\wostmp\
%Windows%\SysWow64\wostmp\
请按以下步骤操作=
要删除恶意软件/灰色软件文件夹：

右键单击“开始”按钮，然后点击 Search... or Find..., 根据您运行的 Windows 版本选择相应操作。

在“名称”输入框中键入：

%Windows%\Fonts\
%Windows%\Fonts\clientdb\
%Windows%\Fonts\clientdb\ds\
%Windows%\Fonts\clientdb\gt\
%Windows%\Fonts\clientdb\MSBuild\
%System%\wostmp\
%Windows%\SysWow64\wostmp\

在Look In 下拉列表，选择 My Computer，然后按Enter键。

定位到该文件夹后，选中并按 Shift+Delete 组合键将其永久删除。

Step 8

搜索并删除这些文件

[ 更多 ]

某些文件可能被隐藏，请务必勾选 搜索隐藏的文件和文件夹 勾选框 "更多进阶选项" 选项，以在搜索结果中包含所有隐藏的文件和文件夹。
%System%\{filename}
%Windows%\SysWow64\{filename}
%System%\wostmp\{malware defined values}
%Windows%\SysWow64\wostmp\{malware defined values}
请按以下步骤操作=
要删除恶意软件/灰色软件文件：

适用于 Windows 7、Server 2008 (R2)、8、8.1、10 及 Server 2012 (R2) 系统：

打开 Windows 资源管理器窗口。
对于 Windows 7 和 Server 2008 (R2) 用户：点击Start>Computer.

对于Windows 8、8.1、10及Server 2012用户, 右键单击屏幕左下角，然后点击 File Explorer.

在搜索计算机/此电脑输入框中，键入：
%System%\{filename}
%Windows%\SysWow64\{filename}
%System%\wostmp\{malware defined values}
%Windows%\SysWow64\wostmp\{malware defined values}

定位到该文件后，选中并按 SHIFT+DELETE 将其删除。

对所有列出的文件重复上述步骤。
*Note:阅读以下微软官方页面若上述步骤在 Windows 7 和 Server 2008 (R2) 系统上无效：

Step 9

以正常模式重启计算机，并使用亚信安全产品扫描检测病毒Trojan.Win64.VICERCON.H. 如果检测到的文件已被亚信安全产品清理、删除或隔离，则无需执行其他操作。您可以选择直接删除隔离文件。请勾选此项知识库页面了解更多信息。