lot of .exe folders are created on my windows7 [duplicate]

Question

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

Hi in my windows7 lot of .exe files are creating. what I have to do I cant install any antivirus. I loss my controll panel access. How can I remove this horrible virus. Please help me

Answer 1

Try that:

1. Create a restoration point
2. Download Process Explorer and Autoruns from www.sysinternals.com

3. Execute Process Explorer at first to identify viruses. Choose "Agree" if a popup with it appears.

   2.0. Process Explorer shows all current running applications/processes including viruses better than Windows Task Manager

   2.1. In the opened windows, right click on header of list (gray bar with the name of columns - name, pid...)

   2.2. Add "Command Line" to see from where the applications are running

   2.3. If you are a super user :) you probably will know what processes are normal Windows processes and what are not. If you don't know, you can be a super user if you want to know that (I'll post some normal processes later).

   2.4. Trick:

   • Read the list from bottom to top
   • Viruses normally are processes in blue or purple
   • Viruses normally are in one of these places (see command line) (I'll correct some of these paths later):
     • Windows system root (c:\windows , %systemroot%)
     • Windows system32 folder (c:\windows\system32 , %systemroot%\system32)
     • Temp folder (c:\documents and settings\your user\local settings\temp , c:\user\your user\application data\roaming\temp , %temp% , %tmp%)
     • Start menu folder
   • Verify company name. If it is empty, misspelled (e.g. Miosoft Corporation) or has a strange name (e.g. Hp Printer when you don't have any Hp product in your machine), it can be a virus
   • Verify name-icon, name-place relation:
     • If the name does not match icon (e.g. a hp process has a adobe icon)
     • If the name does not match place (e.g. lsass in temp folder)

   2.5. Take note of command line of a process you think is a virus. Right click on it and choose suspend to stop its activity. Search in internet for this process name to certify that it can be a virus.

4. Open Autoruns to see all current processes started when Windows initialization. Choose "Agree" if a popup with it appears.

   3.1. Wait for Autoruns start and find all process

   3.2. Search mainly in these tabs for the suspect processes you find and suspended in Process Explorer (but see other tabs also):

   • Logon
   • Explorer
   • Internet Explorer
   • Services

   3.3. Uncheck the processes you think are the viruses (but be careful because if you uncheck wrong processes Windows would not start correctly)

   3.4. Use "Verify" to verify signatures of some processes if you think a signed Microsoft or another known process are suspect

5. Get back to Process Explorer and kill suspect processes (take note of where they where launched in command line column to delete them manually in step 5)

6. Go to Windows Explorer and search and delete suspect applications

7. "Erase" trash

8. Pray and restart.

9. Install a good antivirus software

PS1: Please, show us a list of processes running in your computer if you want to know if one of them is a virus or not.

PS2: Well, I'll improve this tutorial later ;)