Presentation Slide For IT Student - Manually Removing Virus Left Outs

Roshan Karki Unknown

Manually Removing Virus Left Outs

Objectives

The Main Objective is to revert the changes made by virus.
Remove settings that prevents from drives being opened by double click.
Remove error message saying some files not found at startup.
This presentation isn't related in removing virus.

What is computer virus?
According to wikipedia, A computer virus is a computer program that can copy itself and infect a computer without permission or knowledge of the user.

Virus Leftout-1

Symptoms


A dialog box telling it is unable to load certain file, especially boot.vbs.
Appears everytime you log in.
Goes after you click OK.
Some dialogue box remains no matter how manytimes you click OK.

Description


Actually this file alone isn't a virus.
This is a simple file containing nasty script.
Virus changed the setting in your computer to load this file every time you start your computer.
Your system unable to load the missing file produced the error.

How virus programmed it?


Windows Explorer is your default shell for windows.
It provides user interface, including but not limiting to copy, paste, taskbar, desktop and so on.
You can simply take shell as the program containing start menu and desktop icons

How virus programmed it? (contd.)‏


Windows OS decides which shell to load from registry.
Open registry editor by typing regedit in RUN.
Registry contains settings of your Windows OS and registry editor is any software that can manipulate those settings.
Navigate to
HKLM\Software\Microsoft\Windows NT\Current version\Winlogon

As you see from the picture there was a key in registry called shell.
The value of explorer.exe was given to it.
It is telling the OS to load explorer.exe from windows directory as the default shell.

How virus programmed it? (contd.)‏


The problem overhere is explorer.exe takes argument.
Like if you type notepad.exe filename.txt, notepad will open that file automatically.
Similarly if explorer.exe is called as
explorer.exe some_other_program.exe explorer will load that program automatically.

How virus programmed it? (contd.)‏


If you look closely along with explorer.exe there is boot.vbs
boot.vbs is the visual basic script file.
It is the file containing nasty scripts.
Your shell is loading explorer.exe as a shell which in turn is loading the file boot.vbs
Your Anti-virus has removed the nasty file boot.vbs but not this setting.

Removal

Now it is for you to remove it.
Simply double click it and delete all but explorer.exe or whatever your shell is.
Reboot

Virus Leftout-2

Symptoms


A openwith dialouge box appears while opening any drive.
Some strage options appears while right clicking any drive.
Drive Icon might get changed.

Description


This is also not virus.
This is only virus leftouts.
This is simple file used by virus to load itself.
OS reads this file and tries to load the virus which is already deleted by anti-virus.

How virus programmed it?


Windows OS provides Autorun feature.
By double clicking a drive, required program can be opened.
Similarly drive icon can be changed.
And context menu can also be manipulated.
All these settings are under one file.

How virus programmed it?(contd)‏


The file is autorun.inf.
While opening any drive Windows Explorer searches this drive.
This file contains simple commands.
This file is useful to autorun CD and USB thumb drive.

How virus programmed it?(contd)‏


This files structure is
[autorun]
open=Program to auto-open
icon=Drive icon
shell\command_name=new context menu
shell\command_name\command=command

How virus programmed it?(contd)‏


Instead of opening genuine program the virus changed the file to load itself.
The main program in memory changed autorun.inf file of all the drive plugged in the infected computer.
Thats why Thumb Drive easily gets infected.

How virus programmed it?(contd)‏


Your antivirus deleted the virus specified by open=virus.exe or shell/open/command=virus.exe
Windows explorer tried to open virus.exe specified by autorun.inf.
Upon failing it produeces error.

Removal


Simply delete the autorun.inf file from problematic drive.
You can use DOS command too
del c:\autorun.inf /ahrs

Questions

?

Download the ppt slides for Manually Removing Virus Left Outs presentation from here.

Comments

  1. AnonymousMay 9, 2012 at 2:55 PM

    This comment has been removed by a blog administrator.

    ReplyDelete
  2. AnonymousMay 20, 2012 at 6:20 AM

    This comment has been removed by a blog administrator.

    ReplyDelete

Post a Comment

Comments are moderated. No spam please.

Popular posts from this blog

Perm Root HTC Desire Gingerbread 2.3.3

Roshan Karki Anonymous
This guide is for permanently rooting HTC Desire running stock Android Gingerbread 2.3.3 . If you want to temp root then you can follow this guide. Before starting please be aware that problems while rooting can brick your phone. While the process in this guide is relatively simple and easy, I can't be held responsible for whatever happens. Enable USB debugging in your phone by going to  Settings  ->  Applications  ->  Development . Plug in your phone to the computer. Go to Revolutionary website  http://revolutionary.io/  . From there download revolutionary software. Leave this browser tab opened. We need to generate Serial key later. Extract the downloaded software on your computer and run the software with root permission. $sudo ./revolutionary It will tell you your serial number and ask for the beta key. Copy the serial number and go to the browser tab we left open while downloading the software. Put the serial key there...
Read more

Increase Free Space On HTC Desire Android Phones

Roshan Karki Anonymous
Are you running out of free space on phones like HTC Desire and variants? It only has about 150MB of free space and after official Gingerbread 2.3.3 update the free space has decreased. Its really frustrating seeing all those apps with 20MB+ size eating up valuable space on Android phones. Even with App2SD I had very very difficult time maintaining free space. Installing apps like Facebook, Google Plus, Google Reader would eat up all the space. Today I used link2sd to increase free space on my Android phone and now I've more than 1GB of free space for installing apps. I've been installed so so many apps now. link2sd can move your application apk, dex and lib files to second partition of your SD card and creates a symlink where necessary. Even when you mount your SD card in computer the apps in SD card will work as only the first partition will be mounted in computer. Requirements : Root MicroSD card Clockworkmod recovery to partitoin the SD ca...
Read more

Giving Out Google Wave Invitations

Roshan Karki Anonymous
One of our generous reader is offering seven Google Wave invitations. So please put your email address as comment. You can use scr.im to protect your email address from spammers. To get the invitation you don't need to be my regular reader nor you need to be my RSS subscriber. Its not necessary that you have posted comment in this blog. It doesn't matter if you hate me or have kicked me. Invitations will be sent on first come first serve basis.
Read more