Sality Virus

Sality is a family of file infecting viruses that spread by infecting executable files, it runs an autorun worm component that allows it to spread to any removable or discoverable drive. In addition, Sality includes a downloader trojan component that installs additional malware via the Web. So it is a combination of many infections bundled to damage the computer software.  

It will infect executable files on local, removable and remote shared drives. The virus also creates a peer-to-peer (P2P) botnet and receives URLs of additional files to download. It then attempts to disable security software on the computer. It also has key logging functionality . Sality generally drops a .cmd, .pif, and .exe to the root of discoverable drives or removable drives, along with an autorun.inf file which contains instructions to load the dropped file(s) when the drive is accessed. Updates to the malware that is dropped by it are fed via decentralized lists of HTTP URLs.


Removing Sality Virus: 

• Take a registry back up and create a restore point to be on safe side.
• Unregister the file using the command in command prompt Unregsvr32 vcmgcd32.dll
• Remove the file vcmgcd32.dll by searching it using the search option.
• Remove the "Virus.Sality.U" components:
• BwUnin-6.1.4.36-8876480L.exe, syslib32.dll, sysdll.dll, oledsp32.dll and all the files those are associated with that file.

This will remove the virus Virus.Sality.U from the virus.

Read More

SYMPTOMS OF SALITY VIRUS

 

Sality virus is one of its kind; very dangerous and infective. It attacks all the system file components like windows task manager and registry. It is the most important part where we need to take care of as registry values are like wheels of a vehicle, if they get corrupted we may not be able to use the computer as similarly as we cannot use the vehicle if the tires go flat. 

Read More

Computer Virus Infection Strategies

A virus is a program that is written which can copy itself  and has the capability to completely destroy a computer.A true virus can spread from one computer to another if it is targeting the host computer by the infecting the files in the host computer which is on a network.

Read More

"Here you have" Virus

''Here You Have'' is one of the widely spread viruses on the internet these days. It comes as an email to inbox and states like  as the subject  "Subject: Here you have or Just for you". It is also called

W32/VBMania@MM  

Read More

REMOVING VIRUS FROM PENDRIVES

Preventing the virus from entering the PC:

There are some common things that we need to take note of while using a pen drive/ Flash Drive/ Thumb Drive. People use Flash drives for copying data, often the date would be documents or executable files or movies and so on.

 

• One can copy the files directly to prevent the virus that attacks folders mostly in a portable drive. That is the first important thing we need to keep in mind.
• Secondly while opening the PD (portable drive) we should not use the autorun to open it directly. We first need to scan the PD using any good anti- virus before opening it.
• If we find any infections we can fix them. If not fixed if they are skipped or avoided from scanning then we cannot open the PD as usual.

REMOVING IT:

Command prompt can be used for removing virus from pen drive with some familiar and basic CMD commands.

•  Go to Command prompt by clicking on Start Run or by pressing windows logo button + R.   Type the drive letter of the pen drive with a colon following it

•  Then type DIR/A. Check all the files and folders displayed in the list especially for AUTORUN,           RECYCLER and any .exe files which you don't expect in it.

• Type ATTRIB *.* -S -R -H to unhide all hidden and system files.

• Then delete the suspected files one by one using the command DEL FILENAME.EXT. This will delete the files from the drive.

•  Repeat this process for all the folders in that drive.

This will remove the virus from the pen drive for sure.

Note: Never open the files in the pen drive when you have downloaded the files from Internet Cafe directly from windows explorer, cause they are the most important and dangerous places from where we get the infections.

Read More

REMOVING ROOTKITS MANUALLY

The term rootkit is used to describe the mechanisms and techniques whereby malware, including viruses, spyware, and trojans, attempt to hide their presence from spyware blockers, anti-virus, and system management utilities. There are several root kit classifications depending on whether the malware survives reboot and whether it executes in user mode or kernel mode.

Read More

Uninstalling an Anti-virus using removal tools:

REMOVAL TOOLS:

Any anti-virus has got some settings and files installed on different folders in computer. So today we will learn how to uninstall an anti-virus using different uninstalling utilities for different companies. Before we look into it we will need to know why we need to use the utilities to uninstall them using utilities.

Reason why we need to uninstall Anti-virus using tools is to make sure that there are no left over files in registry which cause some problems when we install another anti-virus. If there are more than one anti-virus on the system they will give raise to conflicts among themselves and none of them work.

So to protect our PC from infections and to have a clean one and only one security application we need to use the removal tools to uninstall them.

Names of few tools to uninstall different security programs:

• 
  Norton removal tool
• McAfee consumer product removal tool
• Avast uninstall utility
• Removal tool for Kaspersky products
• Avg remover
• Bit defender uninstall tool

These removal tools will help us in removing the anti-virus that we have installed completely from the computer that will help in installing any other anti-virus programs without any problem.

These are operating system independent. That means they work in XP, vista as well as in win7. Sometimes we need to remove the toolbars that we get along with these full programs. For eg. Panda Anti-Virus Firewall 2010 uninstall tool. Norton Online family, Norton online back and so on these have to be uninstalled separately from either add or remove programs or using concerned removal tools.

Read More