Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Hi in my windows7 lot of .exe files are creating. what I have to do I cant install any antivirus. I loss my controll panel access. How can I remove this horrible virus. Please help me

share|improve this question

marked as duplicate by Daniel Beck, DMA57361 May 19 '11 at 11:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
learner, this is a very common virus. Follow the link Daniel gave you. –  Blomkvist May 19 '11 at 11:42
    
You may try the avira rescue system, it is self explanatory and easy to use. –  Michael K May 19 '11 at 11:55
    
Stop running as admin. You can't handle it. Also, stop installing programs. You can't handle that, either. –  Will May 19 '11 at 15:25
add comment

1 Answer 1

Try that:

  1. Create a restoration point
  2. Download Process Explorer and Autoruns from www.sysinternals.com
  3. Execute Process Explorer at first to identify viruses. Choose "Agree" if a popup with it appears.

    2.0. Process Explorer shows all current running applications/processes including viruses better than Windows Task Manager

    2.1. In the opened windows, right click on header of list (gray bar with the name of columns - name, pid...)

    2.2. Add "Command Line" to see from where the applications are running

    2.3. If you are a super user :) you probably will know what processes are normal Windows processes and what are not. If you don't know, you can be a super user if you want to know that (I'll post some normal processes later).

    2.4. Trick:

    • Read the list from bottom to top
    • Viruses normally are processes in blue or purple
    • Viruses normally are in one of these places (see command line) (I'll correct some of these paths later):
      • Windows system root (c:\windows , %systemroot%)
      • Windows system32 folder (c:\windows\system32 , %systemroot%\system32)
      • Temp folder (c:\documents and settings\your user\local settings\temp , c:\user\your user\application data\roaming\temp , %temp% , %tmp%)
      • Start menu folder
    • Verify company name. If it is empty, misspelled (e.g. Miosoft Corporation) or has a strange name (e.g. Hp Printer when you don't have any Hp product in your machine), it can be a virus
    • Verify name-icon, name-place relation:
      • If the name does not match icon (e.g. a hp process has a adobe icon)
      • If the name does not match place (e.g. lsass in temp folder)

    2.5. Take note of command line of a process you think is a virus. Right click on it and choose suspend to stop its activity. Search in internet for this process name to certify that it can be a virus.

  4. Open Autoruns to see all current processes started when Windows initialization. Choose "Agree" if a popup with it appears.

    3.1. Wait for Autoruns start and find all process

    3.2. Search mainly in these tabs for the suspect processes you find and suspended in Process Explorer (but see other tabs also):

    • Logon
    • Explorer
    • Internet Explorer
    • Services

    3.3. Uncheck the processes you think are the viruses (but be careful because if you uncheck wrong processes Windows would not start correctly)

    3.4. Use "Verify" to verify signatures of some processes if you think a signed Microsoft or another known process are suspect

  5. Get back to Process Explorer and kill suspect processes (take note of where they where launched in command line column to delete them manually in step 5)

  6. Go to Windows Explorer and search and delete suspect applications

  7. "Erase" trash

  8. Pray and restart.

  9. Install a good antivirus software

PS1: Please, show us a list of processes running in your computer if you want to know if one of them is a virus or not.

PS2: Well, I'll improve this tutorial later ;)

share|improve this answer
1  
Why not help the community FAQ and add your answer to the duplicate question (see close reason above)? :) –  slhck May 19 '11 at 12:49
1  
I see now it was closed. Well, I'll improve the response later as I promised and I'll do that :) –  kokbira May 19 '11 at 12:56
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.