Wednesday, January 23, 2008

Are you bothered with Autorun virus?

Step 1:

HOW DO YOU KNOW YOU HAVE AUTORUN VIRUS ON YOUR SYSTEM?

Go to windows explorer or my computer

Right-click on your drive(s) you will see these Chinese or sort of a thing "xioxex"

To reconfirm

Go to tools, folder options

Click on the view tab

Select show hidden files and folders

Uncheck hide protected operating system files (recommended)

Select Apply and OK

Check your drive(s)

The presence of Autorun.vbs and other sorts of Autorun shows that there is a virus on the system.

These viruses when left for a long time will disable your folder options, Run, Registry, Msconfig and ends up deleting or corrupting your document or files.


Step 2:

HOW DO YOU DISABLE THESE VIRUSES FROM REPLICATING?

Select start menu

Click on run and type regedit click ok

Select edit menu and click on find

Type userinit, check "match whole string only", click find next

Double click on the userinit

Delete Autorun.bat only

Close Registry

You had just disable the virus from running each time you boot your system.

NOTE: if you cannot enter your registry that means the virus has deactivated it so you have to go to safe mode and repeat step 2


Step 3

HOW DO YOU REMOVE THE AUTORUN VIRUS?

Now you have to restart you computer

When restarting go to safe mode by pressing F8

When fully booted

Select start menu, click Run

Type cmd, select OK

Type cd\ press enter

Type Attrib –a –s –h –r and press enter

Take note of the spaces in between the command and dashes

Type dir and press enter

You will see all the Autorun viruses and this is what you do.

Type del Autorun.* and press enter follow the same step for all drives that are infected.

Type exit and press enter

Now restart your computer in a normal mode and check you computer again using step 1 and all the viruses are gone….



Happy virus removal

Other

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate the virus process.
2. Delete the original virus file (the location will depend on how the program originally penetrated the victim machine).
3. Delete the following parameters from the system registry

[HKCU\Software\ Microsoft\ Windows\CurrentV ersion\Policies\ System]
DisableTaskMgr = 1
[HKCU\Software\ Microsoft\ Windows\CurrentV ersion\Policies\ Explorer]
NoFolderOptions = 1
[HKLM\SOFTWARE\ Microsoft\ Windows\CurrentV ersion\RunOnce]
"Worms" = "%System%\logon. bat"

4. Delete the following files:

%System%\config\ csrss.exe
%WinDir%\media\ arona.exe
%System%\logon. bat
%System%\config\ autorun.inf
h:\autorun.inf
f:\autorun.inf
i:\autorun.inf
g:\autorun.inf
k:\autorun.inf
l:\autorun.inf
o:\autorun.inf
j:\autorun.inf

5. Update your antivirus databases and perform a full scan of the computer.

Check this one also

http://secunia. com/virus_ information/ 42442/wormw32aut orun/

0 comments: