Showing posts with label autorun. Show all posts
Showing posts with label autorun. Show all posts

Saturday, July 18, 2009

Escape from Autorun Viruses...

You can analyze almost all autorun viruses from the following code:

Open Notepad
Copy the Code below

>>>>>>
echo "Run in HKLM" > %SYSTEMROOT%\tofile.txtREG EXPORT HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "Runonce in HKLM" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "RunonceEX in HKLM" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "Winlogon in HKLM" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "Run in HKCU" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKCU\Software\Microsoft\Windows\CurrentVersion\Run %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "InternetSettings in HKCU" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
echo "Explorer in HKCU" >> %SYSTEMROOT%\tofile.txtREG EXPORT HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer %SYSTEMROOT%\tofile1.txttype %SYSTEMROOT%\tofile1.txt >> %SYSTEMROOT%\tofile.txt
>>>>>>

Save it as abc.bat anywhere you like.

Double Click on the file

Now go to Start>Run and Type : notepad %SYSTEMROOT%\tofile.txt

Happy Removal of Autorun Viruses...