Don't tell me that it has never happened : a few knocks on the door, your neighbour with a sorry look on her face

"I'm really sorry to ask you that, but since you work in the IT field, I wondered if..."

and ten minutes later you're entrusted with a computer crippled by some virus that came bundled with a promising emule download.
  • First thing to do is to get half the job done by finding out the name of the virus. If it tries to open a suspicious webpage or display a specific message, do a web search and try to find a matching description, preferably on Symantec's threat database.

    NB : I have to make myself clear here : I'm not indirectly recommending the use of Symantec software; all I'm saying is that their database is often accurate and comprehensive, which helps much in eliminating viruses manually.

  • Now that you know which files are responsible for the mess, and which registry keys are to be removed, don't bother rebooting in failsafe mode five times in a row. Just disable system recovery on all drives and reboot on the Ultimate Windows Boot CD. This will load a Windows OS from a CD (on the very same principle as a Linux Live CD) and allow you to repair the resident OS without loading a byte of it. You can edit the registry, move files, run various antivirus softwares, fix low level hard drive issues (MBR rewriting, partitioning) and much more.
Give it a try if you're not convinced yet - it cannot be longer than struggling with a well-designed rootkit. You'll thank me when your neighbour comes back with a smile on her face and a box of pâtisseries :)


This post has been completed while listening to :

Ar tonelico II Hymmnos Concert Side Red
Ar tonelico II Hymmnos Concert Side Red "Flame ~ Homura" (Various artists)