Manually Remove Viruses From Your System

**Girvan** · 02-04-2009

hi
i am not frequent user of internet from my home pc and i dont have internet connection on my pc .now i suspect that i have virus on my pc but without internet antivirus updation is not possible is there any way to remove virus manually ?please tell me how to do it ?
thank you .

**timon** · 02-04-2009

you can update antivirus with usb key by taking updates from else where
Without Internet Connection getting Anti-Virus Updates

**deveritt** · 02-04-2009

if you want to manual remove viruses you almost every time have to do this in safe mode because in safemode most viruses dosnt start. Only some few windows component is allowed to run in safemode. So here is what to do.
Step: 1: Start your computer in safemode.
2: If you know where the virus are hiding delete the executable file.
3: Open the registry and go to the keys below and add an : in front of the value of the string that you think its the virus. Like this, if string is "virus" and its value is "c:\virus.exe" change its value to ":c:\virus.exe". The : is like comenting out the value. But if you are sure its the virus you can just delete the string.
Here are the keys you maybe want to look at:
CODE

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Runonce

4: The virus can start itself from some other places to. win.ini is the most common files that viruses can use. Soo you should find the files named win.ini and system.ini and look through them and see if you find anything.
5: Look through the startup folder that is normaly located in your profile directory \Start Menu\Programs\Startup.
6: Try searching for the virus executable to see if its hiding some other place.
7: Finally look through the list of services that windows is running. This list is often located under control panel - administrative tools - services. After this 7 steps just reboot your computer in normal mode and try to figure out if the virus is still there.. If not SUCCESS if yes, try to go back to safe mode and hunt some more. Off course this 7 steps will not work on every virus out there, but many of them.

WARNING: Be careful when in the registery because you can cause serious damage to your system in there.

**johnson22** · 02-04-2009

If you have tried all the solutions listed on our site and still could not disinfect your system then try to manually remove the virus using the instructions below:
In order to compelete the instructions below. You need to have Process Explorer and Autoruns. Download them separately

http://download.sysinternals.com/Fil...ssExplorer.zip

http://download.sysinternals.com/Files/Autoruns.zip

Unpack these and copy exe files to Windows Directory

Close and exit all programs (even from tray) except Internet Explorer or your internet browser
Run process explorer by typing procexp in the start menu Run and do as illustrated.

After collapsing

procexp.exe is Process Explorer’s own process

winword.exe is MS WORD

mspaint.exe is Paint

IEXPLORE.exe is Internet Explorer

Wmplayer.exe is Windows Media Player
If you do see any suspicious process

then right click on it and then properties. In the path: field copy the path and Open Run Dialogue and paste the path there
Now terminate the suspicious task in process explorer
If the same process starts again then suspend the process by right clicking on it and click suspend on the menu. Remove the name of the application from path now listing only folder.

e.g If you have copied C:\WINDOWS\system32\mspaint.exe then remove mspaint.exe and you will see C:\WINDOWS\system32\ this in the Run Dialogue.

Delete Hidden Files

Press Enter to open Explorer and locate the file name whose name you have just removed.After locating the file delete the file.If you can not find the file it must be hidden.
If Show Hidden Files and Folders Option not working Use WinRAR

To remove hidden files Download WinRAR which will show you all hidden files

Now look at the root of every drive to find hidden files.

Delete .exe and autorun.inf like files if you find any. But do not delete these files as these are system files

autoexec.bat, boot.ini, bootmgr,config.sys, io.sys, msdos.sys, ntdetect.com, pagefile.sys,ntldr, hiberfil.sys
Now you have successfully terminated virus process the next thing is to remove those virus files which start upon system start.

Open Autoruns by typing autoruns in the Run Dialogue. Wait while refreshing completes.

In the Options –> Hide Microsoft Entries. And click Refresh button on the interface OR Close the program and start again

After scanning completes select Logon tab and uncheck all the entries be sure do not unselect any Microsoft Entry.Restart system for the changes to take effect.

**Kirtikumar** · 02-04-2009

scanning your system for an Anti-Virus will be the last suggestion

Troubleshooting
Incase of any problem. you did a wrong move. Open Autoruns, in the Options –> Unselect Hide Microsoft Entries. And click Refresh button on the interface OR and select all entries .Close the program and start your system again.