Determining the Variant

Thought most of these viruses does the same thing, but there may be variants of each of them. For example one variant might save itself in the “windows” directory where as the other might save itself in “windows/system32/” directory.

It is not a hard task to do if you have a couple of tools up in hand. I recommend Hijackthis, Super Spyware Removal and UnhackMe. Hijackthis and Super Spyware Removal are free of cost, where as UnhackMe is free to try.

Generate the log using Hijackthis (I may write a complete tutorial on this later) to find out where the virus has hidden itself.

Enabling Task manager

Most of these kinds of viruses directly affect your task manager and folder options. If you find your task manager not working then use the following registry to

Download this Registry file to enable Task Manager

The Final Cleansing

Now scan your computer with UnhackMe for any rootkits. You may be incited to check and verify each start up service and programs that are tied in with Windows Startup. I advice that after the scan completion you restart your computer and scan it again.

Now make a complete system scan using Super Anti Spyware. This is a great application and is updated almost daily with new malware definitions and over all, its free. It can also be used to restore msconfig utility, task manager, folder options etc that might have been denied access by the malware.

Use a better antivirus, AVG works great for me.

Now follow these steps here at How to protect your computer from autorun viruses to ensure you don’t get any such viruses and malware again

Though Windows Vista and Windows 7 allow you to format a drive with NTFS with ease, Windows XP only allows you to format with FAT and FAT32. However this simple trick you let can format with NTFS in Windows XP if you want to and access it at better speed (or probably compression too if you want).
Open Device manager (Right Click on My Computer Icon and Properties, Click on Hardware Tab and then device manager and open it.)

Search for Disk Drives in the Tree and Select your USB Drives Properties (Right Click, Do i need to say ?)

Under Policies Tab select Optimize for performance. Now this will allow you to format USB Drives with NTFS file system.

Now to format your USB drive, right-click the drive and select format. You will find the NTFS option there now.

There is a lot of advantage in using NTFS over FAT File System if you are using these drives for connecting them to computers. The drawback is other devices (mp3 players, DVD players) may or may not support.

Autorun virus are widely seen these days here right in USB thumb drives, external hard disks, PCs and Laptops. People find it very difficult to remove autorun virus. Well I must admit that it is very difficult for a non IT person to work out for a solution for those viruses because they disable almost everything the task manager, registry, folder options and sometimes access to the internet as well. Before going into how to deal with these viruses, I would first like you guys to make sure your PC is well protected to avoid these viruses and malware.

Follow my guide and I can assure you that this will help you prevent autorun viruses to a great extent.

Update Your Protection Software

Well most of you use a paid antivirus I guess like Norton or McAfee. If yes them make sure that they are updated always. I see about atleast 20 viruses, spyware and malware definitions daily when I update so I recommend to keep things updated regularly. For those who can’t buy these we have many freebies for the rescue.

Disable Autorun for External Drives

External media like USB and CD/DVD Drives make use of autorun.inf file to start an application as soon as the drive is initiated. Most of the malware programs create a copy of this file to auto start themselves on the clients PC. And we never don’t need this feature do we? (Only if you are damn lazy to click your mouse)

To get to the configuration screen for this setting, go to Start Menu \ Run and type in:

gpedit.msc

In Group Policy window. You should select Administrative Templates \ System in the tree view:

You will see an item in the right side pane called “Turn off Autoplay”

Double click the item, and set the radio button to Enabled, and change the “Turn off Autoplay on” to All Drives.

Autorun Virus Removal Tools and Anti Spyware Tools

There are many Autorun Virus Removal Tools and malware removal tools available now for free. Personally I recommend these (based on their priority how much useful they are)

Super Anti Spyware (freeware)

Unhack Me (fully functional Evaluation)

Autorun Eater (Free)

Icons Arrangement

I arrange my icons by “Type” and then “sort them by groups” so I don’t click an application thinking it to be folder. Simple yet effective. Isn’t it ?

Right Click to Explore

Make it a habit to Right Click and Explore rather than double clicking the Drive Icon so that you don’t autorun a drive explicitly.

Other features include backup support for changed files, command line support, case sensitivity, multiple file types, subdirectory support, result printing and saving etc. The software works great for all kinds of ASCII files like .txt, .html. .php or batch files or any text files in short. The software is just ~400KB compressed and around 4MB for a windows installer.

Click here to download Simple Search-Replace

Now lets take an example of few folders below

 

 

Select the Rename option 

 

Press Enter 

As you can see the only folder which is not been assigned a sequence number is the last folder of the selected items so this can be done manually.

Here we actually create a virtual drive with any letter that we want, that points to another location in any other drive. Quite Impressive right ? Yeah! Lets see..

Creating A Map Drive

Goto Start > Run > cmd.exe

Use the command subst <virtual drive name:> <local folder path> to map a new drive to the local folder. Here I have mapped the drive with the name X to a folder in my external hard drive.

subst x: j:\movies\

Removing A Map Drive

Use the command subst /d <virtual drive name:. The /d switch will delete the virtual mapped drive

subst /d x: