Malicious Mobile Code

Removing Infected Files

This section assumes that either you or the virus scanner has identified the infected files.

Research the Virus

Get up on the Web and learn as much about the virus as you can from a reliable source to help in its extraction.

Stop Any Virus Services

Viruses like Remote Explorer install themselves as a Windows NT service. If you have identified the malicious service’s name, go to Control Panel → Services → Startup → Disable. This will prevent the malicious service from automatically re-starting during a reboot.

Boot to the Command-line Mode

Like in the detection process, we are trying to keep the virus out of memory so we can disinfect it. In Windows 3.x, 9x, or NT with FAT partitions, consider booting from a known clean DOS disk and getting to a DOS prompt. NTFS partitions will require a clean NT boot diskette.

Delete and Replace Infected Files

If a virus scanner doesn’t clean the virus out of the host file, you should delete the file and restore from a clean source. Often I’ll rename suspected or identified virus files with a .VIR extension. With that extension, they are not likely to cause further harm, but it allows me to reverse the process if I’m mistaken.

In-Use File Replacement

A lot of users do not have an Emergency Recovery Disk, a Windows NT Boot Disk, or the device drivers necessary to create a workable boot disk and access the data on the NTFS partitions. In such cases, it is necessary to allow NT to boot up getting access to the partitions ...