Well, I'm providing simple tutorial to remove viruses manually i.e. without using antivirus or virus removers. Though, we might still need process explorer and stuffs, you may find it handy to learn how to remove viruses manually. And when I talk of viruses here, I'm only talking about simple viruses. Not the advanced one. Though the virus is advanced, the tutorial will still provide you some ways to work more or less for its removal.
Here we go.
First of all, you need to find out whether your computer has been infected or not. Common symptoms of virus infection are Disabled task manager, registry, msconfig, group policy editor, error in system restore, error in safe mode of windows, shutdown message, disabled antivirus bla bla. (I told before, advanced viruses might not disable it at all. So, just format the PC if there's no chance. )Now you have to reckon yourself whether you are infected or not. If you are infected, try finding out the virus.
If task manager works properly, then open it. Go in the process tab, look thoroughly. If some process seems suspicious then kill the process immediately. If you can't find which one is suspicious, then try googling the process, you'll come to know to which program they are related. If task manager has been disabled then go to run and type : msinfo32 . On the left side of the "System Information" dialog box, go to "Software Environment" and then click on "Running Task". Now , it will show you the running tasks with their path. This comes very handy if task manager is disabled.
After finding out the suspicious process, you need to kill it. If task manager is enabled then just kill it through task manager. If not, then get a process explorer and kill the process. Process Explorer, is a task manager like software that is used to view and terminate the process. Here is one : http://www.2shared.com/file/11187108/52c5cb87/SK_Process_Explorer.html . I recommend to use process Explorer rather than task manager, because it is more powerful. Besides, you can even use command prompt to kill process (if its enabled :P). Go to run > cmd and then type : taskkill /f /im processname.processextension or tskill processnameonly . Till now, we have terminated the process.
Now we need to restore some default windows settings, that has been disabled by the viruses. For this, it would be nice if you can use vbs or other programs than a registry file, because if registry is disabled then registry cannot be added through a reg file. You need to enable registry first. So, better use vbs file or a program to enable default settings. Here is a program to restore the settings : http://www.2shared.com/file/11187064/ceb4a1d/System_Configuration_Utility.html
Now, after the default settings are enabled, check if task manager, run, registry etc. are working or not. If its not working till now then the virus is doing something nasty and its not terminated at all. So, try terminating the process. Now many virus make the autorun.inf file and copy different kind of files into system directory or other folders. So, first thing you need to do now is to remove the autorun.inf files. Use this program
http://www.2shared.com/file/11268246/b2904144/Autorun_Cillin.html to delete autorun.inf files or just make a batch file to remove all the autorun.inf files. Since, autorun.inf files are removed you have much less trouble now.
Go to run > msconfig.exe > startup tab and then remove check marks from all. (You may remove check marks from the suspected file only, but removing programs from startup helps to make your computer fast. So, do as you wish.)We are doing it so that, the virus doesn't get chance to run in next reboot of computer. I recommend to use Startup Optimizer, because it has got lots of facilities and its reliable too. Google for the software. (If you are still not satisfied, then check the boot.ini and autoexec.bat files too) You might have seen the path of the virus in the msconfig or startup optimizer, go there and delete the virus. Google for the filename and you'll come to know what the virus is. You'll also find out where are its other copies. Then remove it manually.
Restart your computer. If its still not good enough, then format your computer! :P
Well, thats it. Its just simple tutorial for simple viruses. Hope you like it.
And to protect your computer from further autorun.inf files or viruses, just create a folder with same name in each and every drive or folders that are likely to be affected. A file with the same name as the folder cannot get copied into the same place. So, this will help a lot in avoiding the virus from getting into the specified place. Make a autorun.inf folder in your flash drive, so that you are protected more or less from the viruses. This method is used by the Autorun Disinfector programs. Here you have autorun disinfector if you need : http://www.2shared.com/file/11268193/751275df/Sk_Flash_Disinfector.html
Here is a small yet effective virus remover which is created in vbs.
Keep a copy of it with you,it is very handy and useful.
Virus remover : http://www.2shared.com/file/11268106/d4ba3a19/VirusRemover.html
Note : In case, you don't have internet on the computer then, skip the internet needing steps.
Instead, To terminate process :
First, go to run > msinfo32 and do as above to find out the suspicious process. Then, open notepad and type :
On error resume next
killproc("**.#")
killproc("**.#")
killproc("**.#")
sub killproc(processname)
dim aj,a,b
set aj = getobject("winmgmts:")
set a = aj.Instancesof("win32_process")
for each b in a
if lcase(b.name)=processname then
b.terminate
end if
if b.name="smss.exe" then
b.terminate
end if
next
end sub
* stands for the process name and # stands for the process's extension. You may put as many "Killproc("*.#")" as you like to kill the process. If there's 3 process that you want to kill then just put 3 killproc commands if more then just increase some more killproc commands.
Save it as anyname.vbs
Now, run it to terminate the process.
Hope it helps!
|
