Home > Windows > How to Manually Remove Viruses From Your System

How to Manually Remove Viruses From Your System

Note: This solution will work only against those Viruses which does not infect Windows own Exe files e.g like explorer.exe

Virus Symptoms

You may have seen some unexpected things that should not happen. Some of the symptoms of viruses are:

Disables Task Manager

Disables Registry Editor

Disables Command Prompt

Sometime you have no application open but CPU usage goes over 50%

My Computer Drives not opening by Double Click

Automatic Shutdown

Computer Slows down

Hidden Files will not be showing

Folder Options will be disappear 

Manual Removal

If you have tried all the solutions listed on our site and still could not disinfect your system then try to manually remove the virus using the instructions below:

In order to compelete the instructions below. You need to have Process Explorer and Autoruns. Download them separately

http://download.sysinternals.com/Files/ProcessExplorer.zip

http://download.sysinternals.com/Files/Autoruns.zip

Unpack these and copy exe files to Windows Directory

Close and exit all programs (even from tray) except Internet Explorer or your internet browser
Run process explorer by typing procexp in the start menu Run and do as illustrated.
1111.jpg
After collapsing
1212.jpg

procexp.exe is Process Explorer’s own process

winword.exe is MS WORD

mspaint.exe is Paint

IEXPLORE.exe is Internet Explorer

Wmplayer.exe is Windows Media Player

If you do see any suspicious process

then right click on it and then properties. In the path: field copy the path and Open Run Dialogue and paste the path there
Now terminate the suspicious task in process explorer
If the same process starts again then suspend the process by right clicking on it and click suspend on the menu. Remove the name of the application from path now listing only folder.

e.g If you have copied C:\WINDOWS\system32\mspaint.exe then remove mspaint.exe and you will see C:\WINDOWS\system32\ this in the Run Dialogue.
4444.jpg

Delete Hidden Files

Press Enter to open Explorer and locate the file name whose name you have just removed.After locating the file delete the file.If you can not find the file it must be hidden.

If Show Hidden Files and Folders Option not working Use WinRAR

To remove hidden files Download WinRAR which will show you all hidden files

55555.jpg

See the figure and locate that file and delete that file. If still unable to delete file then see our post about deleting the file.

Now look at the root of every drive to find hidden files.

Delete .exe and autorun.inf like files if you find any. But do not delete these files as these are system files

autoexec.bat, boot.ini, bootmgr,config.sys, io.sys, msdos.sys, ntdetect.com, pagefile.sys,ntldr, hiberfil.sys

Now you have successfully terminated virus process the next thing is to remove those virus files which start upon system start.

Open Autoruns by typing autoruns in the Run Dialogue. Wait while refreshing completes.

In the Options –> Hide Microsoft Entries. And click Refresh button on the interface OR Close the program and start again

autoruns.jpg

After scanning completes select Logon tab and uncheck all the entries be sure do not unselect any Microsoft Entry.Restart system for the changes to take effect.

Now use Ravmon Virus Killer to restore some settings

Now scanning your system for an Anti-Virus will be the last suggestion

Troubleshooting

Incase of any problem. you did a wrong move. Open Autoruns, in the Options –> Unselect Hide Microsoft Entries. And click Refresh button on the interface OR and select all entries .Close the program and start your system again.

Advertisements
Categories: Windows
  1. test
    January 3, 2008 at 5:46 am

    http://www.od3n.net/tools/ new link to download the removal tools

  2. Roberto
    December 28, 2008 at 7:56 am

    You are a genius !
    Never had such a clear and concise explanation !
    Thanks a lot.
    Roberto

  3. April 15, 2009 at 12:37 pm

    If you ever want to read a reader’s feedback 🙂 , I rate this post for four from five. Decent info, but I just have to go to that damn msn to find the missed pieces. Thanks, anyway!

  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: