Instructions

Removal Instructions

While removing any virus files, these are the steps you have to follow in the order given below. Separate instructions are written for different version of Microsoft windows which you can access from their links below.

Using System Restore

If you know the duration since your computer is infected, you can try to restore your computer at a prior date, that will be an easy way to undo the changes done by the virus

Using system restore in windows XP

Using system restore in windows Vista

Using system restore in windows7

Boot in safe mode

Sometimes you can not delete a file. You should boot in safe mode and then try to delete it.

How to boot in safe in windows XP

How to boot in safe mode in windows Vista

How to boot in safe mode in windows7

View Hidden Files

You need to enable to view hidden files and folders before searching.

How to Enable to View Hidden Files and Folders in Windows XP

How to Enable to View Hidden Files and Folders in Windows Vista

How to Enable to View Hidden Files and Folders in Windows7

Remove Processes from Task Manager

Press Ctrl Alt Del keys to open the Task Manager. Select Processes tab. You will see a list. Look for the names of the virus files in it. Generally you will find EXE files in the Task manager. Select the process if found and press the End Process button. It will ask for your confirmation to end that process. Select Yes. You can end one process at a time.

You can find out if a process in Task Manager is good or bad by using Windows Defender in XP and Vista. It shows the path of a process and its publisher. Harmful processes may be shown under Unknown Publisher in windows defender. Whereas in Windows7 you can find that out from the task manager itself

How to use Windows Defender in windows XP

How to use Windows Defender in windows Vista

How to use Windows Defender in windows7

Or you can use Sysinternal's Process Explorer. How to use Sysinternal's Process Explorer

Removing entry from windows startup

The system configuration can be started in xp and in vista by typing msconfig in the run box/ start menu search box. In xp by clicking on Start > run . The windows startup is reversible. You can check / uncheck any entry from windows startup any number of times.

Open system configuration window. Click on the Startup tab. You will see a list all the programs that are scheduled to start with windows. Expand the middle column using your mouse pointer. That will show you the full path of the program. Locate and uncheck the boxes in front of the names of virus files. (also look for any other suspicious names) Press Apply , Press Close/Ok , Select "restart" at the next prompt.

Stopping a Malicious Service

Sometimes a virus creates a malicious service. If it is mentioned in the article, then you can stay in the above step, instead of restarting the computer. Select the Services tab. Look at the list of the services. You can Hide all Microsoft Services to make the list smaller. After that select the service created by the virus. If it is checked, you need to uncheck it, that will stop the service. Otherwise it will not let you delete its file from the hard disk. Press Apply/ Ok to complete the process, and then restart the computer.

Starting Stopped Services

Sometimes a virus stops one or more windows services. It affects the functioning of the windows. You need to start these services, if the virus has stopped them. You can stay in the System Configuration Utility, and select Services tab. Locate the service stopped/ disabled by the virus. It will be unchecked, if it is disabled/ stopped. In that case, check it to start it. Press Apply/ Ok . And restart the computer at the next prompt. Do nothing if the service is already checked.

Searching Files

You can use windows search utility to search for the virus files and find out if there are any other instances of this file present elsewhere in the computer. Do not do this for the files whose names are similar to legitimate windows processes. It is mentioned whenever such is the case. You should delete such malicious clones only from the location where the virus creates them.

You need to select Advanced Options > Search Hidden Files and folders when the virus is created in a Hidden Folder. Generally All the folders under C:\Windows and is subfolders are Hidden by default. And the Application Data folder in the user profile is also hidden. You need to enable to view them, if you intend to locate and delete the viruses in the Hidden folders.

Deleting files

After the computer restarts. Delete the virus files. You may have to delete an entire folder if it is created by the virus. The virus files and the folders are listed in a separate article. Boot in safe mode or boot in the dos prompt if needed. You can use windows search utility to search for the virus files and find out if there are any other instances of this file present elsewhere in the computer.

Generally there is a virus sample uploaded on Threatexpert site. We do not know the name or the location of the sample, it could be in your default download location or on the desktop or in a Temp folder. The files and folders in the Temp folder can be automatically removed, if you use a free temp files/ registry cleaner software like CCleaner

Registry Keys

Some of the registry keys will be automatically removed if you run Registry menu of CCleaner. For other registry changes you can see the report mentioned at the beginning of each article.

Using CCleaner

You can easily remove the files in the temp folder by running CCleaner. You can set CCleaner to run automatically each time the computer starts.

Do not forget to run CCleaner > Registry menu to remove the obsolete registry entries.

Free tools to repair disabled folder options, registry, Task Manager etc

Whereas you can repair disabled Folder Options, disabled Registry Tools, disabled Task Manager, Disabled System Restore etc using these free tools

Tools for Windows XP

Tools for Windows Vista

Tools for Windows7

Using System File Checker

To repair altered windows system files.

How to run System File Checker utility in windows XP

How to run System File Checker utility in windows Vista

How to run System File Checker utility in windows7

Some more Free Tools

Virus infections are complex. Most of the times a virus on the computer downloads more files and make it complicated. In my attempt to warn users about the different ways that viruses are trying to infect and ways to find them and remove, I have created videos on specific Free tools and manual methods, these videos could be of great help

1) To detect and remove malicious Alternate Data Streams - Stream Armour

2) To detect and remove malicious Services - Advanced WinService Manager

3) To detect and remove viruses in Fake recycle Bin - Watch Video

4) keep an eye on suspicious connections using a Firewall - Free Comodo Firewall

5) A free tool to detect and remove unwanted BHOs - SpyBHO Remover

6) To detect a Hidden process in windows - EvilFingers HPD