The right approach to fighting the Virut worm

By: Eujenio de la Garcia
Last month I got a machine riddled with a virus which I could not nail down.

The tendency lately, as far as malware is concerned, is commercial - mainly fooling the user to buy a spoofed antivirus piece of software which emulates the behaviour and looks of another antivirus package. Not this one, though.

I found out that the PC was infected with the so called Virut virus after extensive research based on the fact that almost every executable running in memory was throwing an exeption.

Virut is a worm that spreads in your system by appending itself to executable files (.EXEs). Once it gains control of the compromised machine, every executable you launch after that will consequently get infected with the virus.

Once a machine gets infected with the Virut worm, it becomes very difficult to clean.

In this case the technician/user is presented with two options:

1) Reformat/wipe the whole machine;
2) Try and clean the system (more difficult);

I went down the second route because the customer had set-ups I could not replicate and software they needed but have lost the source CDs/installer files for.

After some trial and error, I found out that the best way to do this is as follows:

- download AVG Virut Removal Tool.
- put it on a USB stick;
- create a bootable CD using BartPE builder;
- connect the USB stick and boot to the CD;
- run the AVG software from the USB stick on your hard drives/partitions;

After the scan is finished, boot into normal Windows mode and run a scan with an up-to-date antivirus package - I recommend Kaspersky Internet Security.
This will be like a double check that the system is clean and free of any infection.
For more practical tips and tricks visit my blog:
http://bigboysdontclick.com
About the Author
Eujenio de la Garcia is a freelance PC technician. He resides and works in the UK.

(ArticlesBase SC #1004079)

Article Source: http://www.articlesbase.com/ - The right approach to fighting the Virut worm

Useful DOS command

Some useful DOS command to remove active virus etc.

Requires DOS or Command prompt.

attrib -h -s -r [filename] [remove file hidden/system file attributes]
dir /a [list files in a directory plus hidden files]
dir /a /s [list files in directory and sub-directory]
tasklist [list running processes]
taskkill /pid /F [kill processes with force by pid]


C:\>help
For more information on a specific command, type HELP command-name
ASSOC Displays or modifies file extension associations.
AT Schedules commands and programs to run on a computer.
ATTRIB Displays or changes file attributes.
BREAK Sets or clears extended CTRL+C checking.
CACLS Displays or modifies access control lists (ACLs) of files.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHCP Displays or sets the active code page number.
CHDIR Displays the name of or changes the current directory.
CHKDSK Checks a disk and displays a status report.
CHKNTFS Displays or modifies the checking of disk at boot time.
CLS Clears the screen.
CMD Starts a new instance of the Windows command interpreter.
COLOR Sets the default console foreground and background colors.
COMP Compares the contents of two files or sets of files.
COMPACT Displays or alters the compression of files on NTFS partitions.
CONVERT Converts FAT volumes to NTFS. You cannot convert the
current drive.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DEL Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
DISKCOMP Compares the contents of two floppy disks.
DISKCOPY Copies the contents of one floppy disk to another.
DOSKEY Edits command lines, recalls Windows commands, and creates macros.
ECHO Displays messages, or turns command echoing on or off.
ENDLOCAL Ends localization of environment changes in a batch file.
ERASE Deletes one or more files.
EXIT Quits the CMD.EXE program (command interpreter).
FC Compares two files or sets of files, and displays the differences
between them.
FIND Searches for a text string in a file or files.
FINDSTR Searches for strings in files.
FOR Runs a specified command for each file in a set of files.
FORMAT Formats a disk for use with Windows.
FTYPE Displays or modifies file types used in file extension associations.
GOTO Directs the Windows command interpreter to a labeled line in a
batch program.
GRAFTABL Enables Windows to display an extended character set in graphics
mode.
HELP Provides Help information for Windows commands.
IF Performs conditional processing in batch programs.
LABEL Creates, changes, or deletes the volume label of a disk.
MD Creates a directory.
MKDIR Creates a directory.
MODE Configures a system device.
MORE Displays output one screen at a time.
MOVE Moves one or more files from one directory to another directory.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by PUSHD.
PRINT Prints a text file.
PROMPT Changes the Windows command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
RECOVER Recovers readable information from a bad or defective disk.
REM Records comments (remarks) in batch files or CONFIG.SYS.
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
SET Displays, sets, or removes Windows environment variables.
SETLOCAL Begins localization of environment changes in a batch file.
SHIFT Shifts the position of replaceable parameters in batch files.
SORT Sorts input.
START Starts a separate window to run a specified program or command.
SUBST Associates a path with a drive letter.
TIME Displays or sets the system time.
TITLE Sets the window title for a CMD.EXE session.
TREE Graphically displays the directory structure of a drive or path.
TYPE Displays the contents of a text file.
VER Displays the Windows version.
VERIFY Tells Windows whether to verify that your files are written
correctly to a disk.
VOL Displays a disk volume label and serial number.
XCOPY Copies files and directory trees.

C:\>