First step is to use other OS on your unit, I used liveCD puppy linux because it's such a small Linux distro and can be installed on a CD or Flashdrive. You can use other linux live Cds.
When you first boot to puppy this is how it will look like:
Now, you should mount the drives in your computer, you just click on that flash drive icon with mount label
This next picture was captured using my cellphone camera. While working on an infected unit. This is the puppy drive mounter. I used my kingston flash drive to boot. Here you need to click on that mount buttons to see the contents of the 2 ntfs partitions of the harddrive.
After you mounted the first Partition, which I forgot to take pictures, you should delete the autorun.inf, efghi.pif, backup.exe, do not delete.exe unknown artist.exe list.exe, workbook1.exethen then the next step is to look for the folder MSI in the root directory of the 1st partition or your drive C
One click in puppy will open program or folder, so just click once, these are the files inside the folder.
Delete All the the files inside that MSI folder. To delete all at once, first you have to select all the files there, you press Ctrl on your keyboard and clicking individually on the files listed there. Then right click in one of the selected file, choosing the delete option as shown below.
Now, the delete dialog will appear, click on the quiet checkbox so that you don't have to click yes for each file.
After you have deleted all the files in the MSI folder, go back to root directory, follow the following pictures where to click, you can follow the pictures here where to click next.
Now here in the start-up folder, also you should delete all the files here.
Then Go back to root folder again, now we will go inside windows folder to get the userinit.exe file.
Once you have located the userinit.exe file inside the windows\system32 folder, move the window aside. We will use drag and drop here to transfer this file to the MSI folder
open up MSI folder in a separate window, and drag the userinit.exe from the windows\system32 folder, it should be similar to this picture below.
When you release the mouse, select copy from the selection menu.
The userinit.exe file should be the only file in the MSI folder now.
Now Rename it to usirinit.exe, (right-click on the file and select rename)
Next, if you have more than one partition, you should mount it, and delete the autorun.inf from the root directory, and also the files: efghi.pif, Backup.exe, Do not delete.exe, List.exe, Unknown Artist.exe and Workbook1.exe.
The final step is to browse every folder that has these files, and just delete it. When you're finished, remove the puppy cd on your cd-rom drive, or if you use usb, unmount it, and restart your pc.
If there's no other problem or other damages by other viruses, your computer will start normally with the virus now.
Is this article helpful to you?
Then, please help me earn a cent of a dollar by just clicking some ads for 30 seconds!
You can do that by signing up a free personal account in Alertpay.com
and then register to bux.to using my referal, and then click even 5 ads
Is this article helpful to you?
Then, please help me earn a cent of a dollar by just clicking some ads for 30 seconds!
You can do that by signing up a free personal account in Alertpay.com
and then register to bux.to using my referal, and then click even 5 ads
