Monday, January 21, 2008

Manually Removing Viruses ( Part 1)

Last month, I had my machine infected with a couple of viruses and had to delete them manually. In the process I learned quite a lot of stuff about viruses. In addition I came accross some very usefull set of tools.

1. How do you know whether you system is infected by a virus. Following are the most common set of symtoms of virus infected machine.
1. Disables Task Manager.
2. Disables Command prompt
3. Diables Registry editor
4. Computer Slows down
5. Folder options menu removed
6. Show Hidden files option disabled.
7. My Computer drive now open by double click.
8. Automatic shutdown

Most of the viruses put an autorun entry when they infect a machine so that, when the system boots up next time, the virus is automatically executed. So even if we find and delete the virus from one location, next moment , the virus will be back there because the virus process is running. Therefore you will need a tool that enables you to see the running processes and autorun entries.

Process Expolrer
and Autoruns are two such very usefull tools.

Since most of the viruses will have the hidden attribute set, and they disables the show hidden files option, you will need a tool that enables you to see the hidden files. One such tool is WINRAR.

Before going to to detail on how get rid of viruses, It is important to know how to stay out of viruses.

The most common way of virus spreading nowadays is through usb pen drives. When you have the autorun feature enabled ( this is the default ), the moment you plug in an
infected pen drive, your machine will also get the virus.
So the first step in preventing viruses is to disable the autorun.

You can find how to disable autorun from here.

No comments:

Post a Comment