Sie sind auf Seite 1von 4

A macro virus becomes active when a document infected with the virus is opened using the program it is

designed to attack. The program must have its ability to run macros enabled (turned on). Generally, when
a virus in a document becomes active, it will spread to global settings for the application so that other
documents will become infected when they are opened. When an infected document is opened on
another computer, the global settings used by that copy of the application will be infected as well.

Multipartite
a virus that attempts to attack both the boot sector and the executable, or program, files at the same time.
When the virus attaches to the boot sector, it will in turn affect the systems files, and when the virus
attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated.
''SAVE THIS FILE AS "SOMENAME.VBS" AND RUN IT
On Error Resume Next
Dim fso
Set fso = WScript.CreateObject("Scripting.Filesystemobject")
'' REPLACE THE "X:\" BELOW WITH THE DRIVE PATH OF YOUR
'' PORTABLE HARDDRIVE FOR EG. WITH "D:\" IF D:\ IS YOUR
'' PORTABLE HARDDRIVE's PATH
Set drv = fso.GetFolder("X:\")
For Each dir In drv.SubFolders
unfile(dir.Path)
Next

'' DOES NOT DELETE THE .EXE FILES AS THEY COULD ALSO
'' INCLUDE YOUR OWN APPLICATIONS
Function unfile(fp)
For Each fil In fso.GetFolder(fp).Files
If (Right(fil.Path, 4) = ".exe") Then
fso.GetFile(fil.Path).Move(fil.Path & ".REPLACED")
End If
fil.Attributes = 0
Next

'' MAKES ALL YOUR HIDDEN FILES AND FOLDERS VISIBLE


For Each fol In fso.GetFolder(fp).SubFolders
fol.Attributes = 0
unfile(fol.path)
Next
End Function

1.

Goes to your Portable HardDisk Path ("X:\" in this case)


2. Goes through each of the Application(.exe) Files
3. Renames those Programs (Files of No.2) with NEW File-Extension ".exe.Replaced" instead of ".exe".
4. Un-Hides all the Hidden Files and Folders in the working Folder.
5. Does Step 1 to 4 to all the files and folders

Also Right Click the Script and Run As Administrator if you're using Windows 7
and don't use it on your SystemDrive(The Drive in which you have your Windows OS installed).
AcerLappy - Jan 30, 2013 08:38PM
Also to be sure it's Autorun Modules(if any) are deleted, run this tool too:
http://en.kioskea.net/download/download-11613-autorun-exterminator

How to remove autorun recycler virus completely

Sometimes, you may see an Recycler folder in the root of each drive in
USB drives or
hard disk and you may treat it as recycler virus. The Recycler folder is an system folder that used
to keep the deleted files, when you want to recover the deleted data before, the system will
recover them from the Recyclers folder. You can click into the folder, and find the deleted files,
picture, folders in it.

The attribute of Recycler folder is hidden, only when the 'show hidden
files and folders' option is checked, you can see it.

Also System Volume Information is a system folder, it save the system restoration information.
However, more and more autorun virus hide themselves in the recycler bin folder, if you find any
executable file such as RECYCLER.exe, or vbs file in it, and autorun.inf file in the root of the
drive, and the content as
[AutoRun]
open=RECYCLER.exe
shellexecute=RECYCLER.exe
shell\Auto\command=RECYCLE.exe

That means your computer and USB sticks have been infected with virus.
Remove viruses in Recycler folder

Update antivirus software such as AVG, kaspersky, Nod32 to the latest version, do a thorough
scan of the computer and USB storage devices. If the virus/worms come back again after
removal, or the antivirus software could not detect the virus even, try to remove the virus
manually.
1. Reboot your system and tap F8 to enter safe mode;
2. Close the RECYCLER.exe process in the task manager;
3. Delete the autorun.inf and other suspicious exe files in the recycler folder
4. Open registry editor and modify the NoDriveTypeAutoRun key with 03ffffff in following
key: HKEY_LOCAL_MACHINE\SOFTWARE\ and
HKEY_CURRENT_USER\SOFTWARE
5. Using the antivirus product to scan again.
The manual removal of the infection is not recommended because it requires an expertise to edit
registry. In case you modify a registry entry wrongly, that may cause damage to the system.
Therefore, it is always better to remove virus with a specialized removal tool.
Using Recycler Virus Removal Tool to delete the virus automatically

Autorun Remover is a specialized autorun removal tool to clean the autorun type virus including
recycler virus, with it, you can get rid of the autorun.inf and recycler.exe easily and quickly.

1. Download and install Autorun Virus Remover;


2. if you USB drives has autorun.inf folder in it, insert it into computer;
3. Execute the tool, Click 'Start' to execute the scan.

If Autorun Remover is blocked by the recyclers virus then run system in safe mode and try again.
To do this reboot your system and tap F8 repeatedly when system starts up.
Autorun Virus Remover is the most effectively autorun antivirus software in the market, with
the product, it is an easy job for you to block any autorun.inf virus from USB drives, click to get
more information about it.

Das könnte Ihnen auch gefallen