Preventing your computer and laptop from monster of all viruses:
Have you ever felt like infected by a virus which makes your pc run like Pentium ii with 32Mb of RAM or disables the Ctrt+Alt+Del option or “folder option” from tools menu.
To get rid of it you formatted your pc but system is infected in few hours of re-installation of windows then you are the victim of most common virus which infects the pc and mainly transferred by removable storage device like pen drive, USB Hard drive and memory cards.
More then 50% of pc I have repaired are
Tip: Never open any pen drive or memory card by double clicking always it may be infected by autorun virus.
infected of this kind of virus and the rest of pc have a costly antivirus installed on it which is regurly updated or some of them dose not use removable storage devise
I will guide you through how to protect your system having Windows XP or Windows 2003 from this type of virus without any antivirus just by few precaution
The Attack strategy
The possibility of getting a CD infected by virus is very less coz the program that control the writing of a CD or DVD can not modified to write virus files on disk may be coz there are many type of different CD\DVD writing software available nower days.
Before understanding the attack strategy of virus we must understand what they really are, the virus are program which are developed by programmer to harm a computer system.
But as it is a program it has a limitation that it cannot run automatically it has to be activated for infecting a system.
So mostly new virus mainly uses two attacking strategy
1) Activation by double clicking
And
2) Activation using autorun feature of CD\DVD
Clicking technique
The programmer gives the virus program a common icon or an attractive icon so the user accidentally clicks on the icon and the devil is activated to attack the system.
The common icon used by virus is the icon of an folder coz when the virus has an icon of an folder it is hard to differentiate between the virus and the normal folder and some times in search of some files we accidentally activates the virus some time it has names like “New folder” which is common in windows and some times it has programmed to obtain the name of the folder in which is stays like if a memory card or pen drive have a folder name data the if the system is infected by this type of virus then an virus is created in the data directory named as New folder.exe and having icon of folder but in normal computer the common extension are hidden by the system so the virus named New folder.exe appears to be an folder without an extension and if your system is infected by this type of virus it will disable the option from which enable the user to see extension of all files on the system.
Other most conmen icon for virus is of MS Excl and appears as office.xsl, currie user try to open the file but nothings happens but now the vius is activated so you cannot delete the file coz if we try to delete it then it is recreated itself actually the full file name of this virus is office.xls.exe
The virus may be in many different icons too like icon of a media file or VLC player etc
Autorun Method
Every computer user is familiar with CD\DVD which have an icon and automatically starts installing itself when double clicked like CD of any Microsoft OS, MS office or any game disc etc.
This type of disc uses a file name autorun.inf for this type of work which can be opened using Notepad. This file can be used to give any icon to drive or to decide which program will execute when drive is double clicked.
The content of autorun.inf is usually
This is the good side of autorun feature but now we will understand the dark side of it.
Imagine what if the command of executing the virus is written on the autorun file. Then every time we double click on the drive the virus is executed. This is what happens with our loved pen drive and memory card.
Every time when an infected pen drive or card is connected with a non infected system and opened by double clicking the autorun file present in the root directory of the pen drive activates the virus which is in hidden format.
Now the attack starts
ü The virus copies it self to the root of every drive along with the autorun file.
ü It copy itself to system folders
ü Add it self to registry
ü Disable the Registry editor
ü Disables the method of viewing hidden files
ü Disables the Task manager which appears when we click Ctrl+Alt+Del
ü Enable him self to run on startup
<![if !supportLists]>ü <![endif]>Disable the MSCONFIG Option which can be used to remove virus from startup
<![if !supportLists]>ü <![endif]>Some times the virus also block some web sites like orkut
Depending on virus some of above tasks are not perform but most of them are common for every such type of virus
Now your pc is infected so every removable drive connected to your system will be infected automatically and ready to infect another system.
Symptoms
Now the question is how you will know that your pc is infected
Just follow few procedure to know your system is infected or not
1) Try to hit Ctrl+Alt+Del and see if the task manager is opening or not
*if task manager not opening then the system is infected.
2) Go to My Computer and check if the folder option is there on the tools menu or not
*if folder option is not visible then the system is infected
3) If you cannot view the hidden files even enabling the option from “tools>folder option>view>show hidden files folder “
4) Go to Start>Run and type “MSCONFIG” and “REGEDIT”
Check if both the program is running or not, one by one.
*If MSCONFIG or REGEDIT is not running the system is infected
5) Open Notepad and go to file menu and click on open and go to root directory of any drive and in file name type autorun.inf and click on open, if any file is open then your pc may be infected
If your computer is infected with virus you have to install a new antivirus with latest update or you have to go through a painful and time consuming formatting process
Tip: I will recommend Avast Antivirus 4.8 Home antivirus it is free to download and can be updated regularly for free.
Precautions
If your computer is not infected by virus you can take few precautions to prevent your pc from being infected
1) The God of all precautions, never use any Removable storage device.
2) In tools>folder option>view
- click “Show hidden files and folders”
-remove the tick mark form “hide extension for known file type” and “hide protected operating system files”
(Removing the tick mark form “hide extension for known file type” will enable the extension i.e. .exe format so the virus having fake icon can be distinguished and deleted. The autorun.inf is a system file so removing the tick mark form “hide protected operating system files” will make it visible to delete)
3) Never open any pen drive or memory card by double clicking always it may be infected by autorun virus.
>open the drive by right clicking on it and selecting explorer
Or
>go to Start>Run and enter the drive name and press OK
Or
>in my computer click on the address bar dropdown arrow and click on your pen drive
These three methods will bypass the autorun.inf file
If autorun.inf is present then open it and check the command search the command “open=”
Like
This will give you the name of virus which is in the pen drive, in this example the virus name “1weicxa.com”
Few common virus name is Smss.exe, N1detct.exe, d.com, 1weicxa.com etc some of the virus also have the extension of .bat or .com
After that you have to delete the autorun.inf and related virus file too.
4) While opening pen drive if you find any folder icon with .exe extension delete it immediately
5) For precaution you can search the removable drive for any unknown exe file and com or bat files
Just before searching go to searching option>advance option and tick on “search system folders”,”search hidden files and folders” and “search subfolders”
Search for *.exe,*.com and *.bat
6) Never open any unknown file on pen drive which is not copied to pen drive by you or your friend.
Formatting Your Infected System
Finally if you are screwed up with virus problem and decide to format the pc then follow few of my instruction other wise your pc may be infected again after few minutes of re-installation
If you are formatting whole hard drive then it is ok but if you are only formatting the c: drive then when the installation is over do not open any of other drive by double clicking on it because it may spread the autorun virus again to your pc just go to my computer in tools>folder option>view
- click “Show hidden files and folders”
-remove the tick mark form “hide extension for known file type” and “hide protected operating system files”
Now
>open the remaining other drives by right clicking on it and selecting explorer
Or
>go to Start>Run and enter the drive name and press OK
Or
>in my computer click on the address bar dropdown arrow and click on your drive (i.e. d: or e:)
This three methods will bypass the autorun.inf file
If autorun.inf is present then open it and check the command search the command “open=”
Like
“open=virus.exe”
This will give you the name of virus which is in the pen drive, in this example the virus name “virus.exe”
Then delete both the files from all other drives
Now you have to search the other drives for virus having folder icon so search the other drives(except c:) for all *.exe files(Just before searching go to searching option>advance option and tick on “search system folders”, ”search hidden files and folders” and “search subfolders”)
Now arrange all exe by size and see if there are any exe with folder icon if your computer was infected with such type of virus then you will find many files having folder icon this all exe will have same size so they will be grouped together and can be easy to delete
Now after these two tests are complete you can use your pc normally and can protect your pc from pen drive virus by just precaution without any antivirus.
Tips
Hear is a cool tip for protecting your pen drive and memory card from virus of your friends computer
1) Find a cool icon for your pen drive (like in example we are taking icon name “icon_name.ico”)
2) Create a txt file and name it autorun.inf
it will look like this
Type the command in it
And save it to the root directory of removable drive along with the icon file.
This will create a cool icon for your pen drive or memory card and if you use your pen drive on friends computer which is infected with autorun virus then it will over write the autorun.inf created by you and the icon will then be disappeared and you will directly come to know that your pen drive is infected or not this trick will also work on other drives like c: or d:
