Monday, February 01, 2010

Strange Computer Virus

This might be the first time I am posting a computer cleanup instruction on this blog, but I feel compelled since several people around me have been complaining about a common set of symptoms hitting their computers recently. I thought I could share some steps that a colleague took to successfully clean an infected system.


The purpose of this post is for informational purposes only and to share some steps performed on an infected system to fix a computer virus, related to symptoms described in the Problem section of this post. I don't know the name of the virus at this time. And, please don't go and modify the registry unless you know what you are doing.


System virus, automatically redirects internet explorer to a site that requests purchase of an anti-virus product. Task manager becomes blocked and inaccessible.


Part I

* Boot the infected system and at the BIOS Press [F8] (Prior to Windows Displaying)
* Select “Safe Mode”
* Log in with the local administrator account
* Start, Run, Type MSCONFIG, and click OK
* Open Windows Explorer, and invoke the file property view and select “show hide files..”

* Look for a strange file type without much detail pointing directly to a user profile, sub to the application directory. Eg. “Document and Settings” > “User Profile”…..”
* Deselect the file and write the file name down. This will prevent it from launching during start up.
* Reboot into Safe Mode again.
* Log in as the local Administrator account.
* Browse to: “Document and Settings” > “User Profile”….. abs search for file name written down in the previous step.

Part II

* On a separate computer, download ATF-Cleaner
* Copy ATF-Cleaner.exe to a USB drive so that you can move it onto the infected system
* Copy ATF-Cleaner.exe to the desktop of the infected system
* Double-click and run ATF-Cleaner.exe
* Click “Select and Delete All”
* Now review search results and delete directory where file is contained.
* Open Regedit – and Export a copy of the registry
* Select Edit > Find and Search for file.
* Delete file reference key
* Reboot
* Login in Windows in normal mode and test

No comments:

Blog Archive