The Virus Crime
There are a lot of virus nowadays, resulting various infection to the computer. Recently I got my friend’s computer got infected by virus. Even she has installed antivirus, but the virus still can penetrate the antivirus defense after activated since she plugged the infected flash disk into the computer. And the virus create these problems:
- Disable Task Manager, Regedit, Folder Options, Run, Find, Msconfig, cmd, install
- Create .exe file from .doc, .txt, and .jpg files and “super hidden” source files
- Disable .exe files so that I can’t run/install any program
- The virus also active in Safe Mode
Counter Attack
To counter attack the virus, I prepare the weapons to fight it: BartPE CD, HijackThis, good Anti Virus with the latest update, .inf file with code.
Bart PE: Eliminate the Main Virus File
Information about BartPE. Boot with BartPE. Run the file explorer and search the files. I delete spool32.exe (the information from the alert message from current antivirus) and .exe files with icon folder in windows folder. Also autorun.inf and the .exe file with icon folder from each drive. If you doubt about the autorun.inf, just open it, it safe. Read the text and if it try to running suspicious application, then delete it. I assume that after this action taken, the virus won’t be start along with the Windows.
After restart, I go to safe mode.
Repair the Registry
I use the .inf file and HijackThis to repair registry.
- Download the .inf file here. This file to repair some damages like cannot run regedit or cmd.
- Extract it and right click the .inf file choose Install item.
- I also use HijackThis application to delete suspicious registry entry and disabled the autorun virus file. Information about HijackThis
Restart computer and boot to normal Windows.
Install Reliable Antivirus and Update it!
I uninstall the current antivirus and install the new one and update it. After that, I start to scan the computer. And surprisingly it got more than 20000 virus after scanning more than three hours.
It took about 10 hours since I turn on the computer and examine the virus until the virus deleted.
Unhide the “super hidden” file
Start -> Run -> type cmd. Go to a root drive. Type this:attrib X:\*.* -s -h /s /d
X is the drive letter.
Disable the Autorun of removable disk
Since the virus can spread automatically from your flash disk, disable the autorun by doing this:
- Start -> Run
- Type gpedit.msc
- Computer Configuration -> Administrative Templates -> System
- Right Click/Double Click Turn off Autoplay
- Choose Enabled and Turn off Autoplay on All drives. OK.
