Manually Removing Viruses From PC

Manually Removing Viruses From PC
Have you ever been in the possition that you know you have an virus but you dont have any antivirus?? Its almost impossible to remove it manual without knowing about a few tips & tricks.
After reading this turtorial im sure you will know how to manual remove most of the virus lurking around. But that dosnt mean you shouldnt have any anti virus on you computer!
Anyway, lets get starting with the turtorial.. I suppose you already know what safe mode is. If you dont try pressing the F8 key some times when you start your computer. You havto do this when your computer is about to start the first windows components. In win2k or xp i think you can press space and then F8 when it ask you if you want to go back to previous working setting.
Enough talk about how to start you computer in safe mode, but if you want to manual remove viruses you almost everytime haveto do this in safe mode becouse in safemode most viruses dosnt start. Only some few windows component is allowed to run in safemode. So here is what to do.
Step: 1: Start your computer in safemode.
2: If you know where the virus are hiding delete the executable file.
3: Open the registry and go to the keys below and add an : in front of the value of the string that you think its the virus. Like this, if string is "virus" and its value is "c:\virus.exe" change its value to ":c:\virus.exe". The : is like comenting out the value. But if you are sure its the virus you can just delete the string.


Here are the keys you maybe want to look at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce
4: The virus can start itself from some other places to. win.ini is the most common files that viruses can use. Soo you should find the files named win.ini and system.ini and look through them and see if you find anything.
5: Look through the startup folder that is normaly located in your profile directory \Start Menu\Programs\Startup.
6: Try searching for the virus executable to see if its hiding some other place.
7: Finally look through the list of services that windows is running. This list is often located under control panel - administrative tools - services. After this 7 steps just reboot your computer in normal mode and try to figure out if the virus is still there..If not SUCCESS if yes, try to go back to safe mode and hunt some more. Off course this 7 steps will not work on every virus out there, but many of them.

-Be carefull with the registery, dont mess it up, if u do ur computer is ****** lol, depends on wat u mess up, i suggest u made a system restore point first, so incase someting happens you can go back on it. -

1. You can edit the hidden autorun.inf file in the root directory! with some cmd commands like chkdsk etc... also u can do this... open autorun.inf see the contents in it (using notepad) if anything comes with shell= or openshell= see the file name... it maybe .vbs / .exe / .cmd / .dll... anything... search tht file... delete that file first and then delete the autorun.inf.. in most cases u can find more than 1 file in the shell scripts (the line that has a word shell in autorun.inf).
2. Edit system.ini file (ok whn i say edit , it means open in notepad) see the contents..
It may come up with some different stuf and associate any .exe .dll etc... however some .dlls are stored by s/w and some by virus so it maybe difficult to find out which one is malicious. Show the file to some knowledgelble person or in tht case u can post this issue here! and you will be guided correctly.

In most cases, task manager is turned off, so to chek the background processes u can download hijack this! from internet.. its about 700kB and its FREE!! Google for the s/w.