Jump to content


Check out our Community Blogs

Register and join over 40,000 other developers!


Recent Status Updates

View All Updates

Photo

Manually Removing PC Viruses


  • Please log in to reply
3 replies to this topic

#1 pranky

pranky

    CC Newcomer

  • Just Joined
  • PipPip
  • 11 posts

Posted 21 January 2007 - 12:11 PM

Manually Removing PC Viruses

Have you ever been in the possition that you know you have an virus but you dont have any antivirus?? Its almost impossible to remove it manual without knowing about a few tips & tricks.
After reading this turtorial im sure you will know how to manual remove most of the virus lurking around. But that dosnt mean you shouldnt have any anti virus on you computer!
Anyway, lets get starting with the turtorial.. I suppose you already know what safe mode is. If you dont try pressing the F8 key some times when you start your computer. You havto do this when your computer is about to start the first windows components. In win2k or xp i think you can press space and then F8 when it ask you if you want to go back to previous working setting.
Enough talk about how to start you computer in safe mode, but if you want to manual remove viruses you almost everytime haveto do this in safe mode becouse in safemode most viruses dosnt start. Only some few windows component is allowed to run in safemode. So here is what to do.
Step: 1: Start your computer in safemode.
2: If you know where the virus are hiding delete the executable file.
3: Open the registry and go to the keys below and add an : in front of the value of the string that you think its the virus. Like this, if string is "virus" and its value is "c:\virus.exe" change its value to ":c:\virus.exe". The : is like comenting out the value. But if you are sure its the virus you can just delete the string.
Here are the keys you maybe want to look at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
4: The virus can start itself from some other places to. win.ini is the most common files that viruses can use. Soo you should find the files named win.ini and system.ini and look through them and see if you find anything.
5: Look through the startup folder that is normaly located in your profile directory \Start Menu\Programs\Startup.
6: Try searching for the virus executable to see if its hiding some other place.
7: Finally look through the list of services that windows is running. This list is often located under control panel - administrative tools - services. After this 7 steps just reboot your computer in normal mode and try to figure out if the virus is still there.. If not SUCCESS if yes, try to go back to safe mode and hunt some more. Off course this 7 steps will not work on every virus out there, but many of them.

-Be carefull with the registery, dont mess it up, if u do ur computer is ****** lol, depends on wat u mess up, i suggest u made a system restore point first, so incase someting happens you can go back on it. -
  • 0

#2 xtraze

xtraze

    CC Devotee

  • Just Joined
  • PipPipPipPipPipPip
  • 872 posts

Posted 21 January 2007 - 05:54 PM

Thanks for giving the list,
I already knew most but I didn't know win.ini ans sytem.ini
  • 0

#3 techni68

techni68

    CC Addict

  • Just Joined
  • PipPipPipPipPip
  • 211 posts

Posted 24 January 2007 - 09:39 AM

Thanks for the tips about how to manually remove viruses.. I am going to save this after I print it off:)
  • 0

#4 AfTriX

AfTriX

    CC Devotee

  • Just Joined
  • PipPipPipPipPipPip
  • 541 posts

Posted 25 January 2007 - 09:14 AM

All these days I was trying deleting only under the current user part, not under the Local Machine part. thanks a bunch for the tip. Me Copying Your Method Now.
  • 0