Monday, 19 May 2008

recently I got infected by virus about autorun.inf and printer.exe
when my usb thumb put in the computer it will replicate itself

to clean it
i surf the web

delete these keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
mswindws mssql.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
mswindws mssql.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
shell Explorer.exe work.exe

manually kill these processes using procexp from sysinternal or task manager:
%systemroot%\system32\cftmons.exe
%systemroot%\system32\work.exe
%systemroot%\system32\mssql.exe

del the files mentioned above
files are with hidden and system attrib
so using the command:
attrib -s -h cftmons.exe
and so on

No comments:

Labels

Search This Blog