Resolving virus-infected computer

Question

0.00/5 (No votes)

See more:

HI! CAN ANYBODY HELP ME!!! While i was trying to copy a non-executable virus called "Virus.Win32.VB.lr" The name of the file is the same as what it called. Then i try to scan it with ClamAV then unexpectedently, the virus executed. I try to turn on kaspersky again to check if it is a virus, then it is true! I quickly choose the advanced disinfiction mode to remove this virus. But then i realised that my background changed and my clock is also changed. My clock is not showing **:** AM/PM but now show **:** riesyha/riesyha. Can i know how the virus change my clock from displaying **:** AM/PM to **:** riesyha/riesyha.

Thanks! :)

What I have tried:

I tried to use the kaspersky feature which is "Microsoft Windows Troubleshooting" to fix the clock but it didn't work. Only when i change the region in the windows settings then it worked.

Posted 10-Jan-21 19:57pm

Abraham Tinonahon silitonga

Updated 11-Jan-21 4:33am

Add a Solution

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2021-01-10T20:52:00

Congratulations!
You have been playing with viruses on a live system and you have been bitten by one.

Quote:
I know this is hard and also very complicated but i still want to do it. So thats why from now i am downloading all possible viruses that i can find. Right now i have a part of them. Which is actually from VXHeaven. I try to use md5 scanning method but doesn't work. So i learn another method which is the virus signature itself. But i also learn that is was possible only in C, C++ And i am still learning VB. C, C++ is so complicated!

Reformat your hard disk, and reinstall Windows from a clean source. And then either stop playing around with viruses - this is a damn good idea - or wait until you have both enough technical experience in your chosen language and the basic "working on viruses" knowledge to know to use a sandbox or VM rather than a live machine.

I suspect you are trying to write your own "virus scanner" or "antivirus", but you disabled your virus scanner to play with live viruses on your live system: you are an idiot, and you should have expected this to happen. You have no idea how many other viruses you have "installed" and a reformat and reinstall is the only sensible way to get back to a "clean" system. Remember that you also get MBR viruses, so you'll need to clean that as well.

Dave Kreskowiak · Answer 2 · 2021-01-11T04:33:00

Solution 2

Well, if you had any sense, you would NOT have been playing around with viruses on your live machine that you need.

You do it on virtual machines that you can snapshot and roll back. That way, you always start with a known clean machine. The virus cannot make the jump from the VM to your live machine. Well, not unless you do REALLY ostupid things.

Oh, and just copying a file infected with a virus will NEVER execute the virus. Scanning the file with a virus scanner will NEVER execute the virus. You have to launch the infected file for the virus to be executed.

You messed up. You really have no choice but to wipe your machine and rebuild from scratch.

Posted 11-Jan-21 4:33am

Dave Kreskowiak

Comments

Abraham Tinonahon silitonga 20-Jan-21 23:08pm

Oh about that one, i think that i tried to use clamAV to scan the file and showed that the file was clean. So i tried to make a new database and add the file. But then when i tried to use the database to scan the file again using clamAV, It finish scanning and the virus execute. I check where the virus location is but then i saw that it was the same directory where i keep it. The original file name was Virus.Win32.VB.LR

It was not an executable. I check it using command prompt and explorer but both of them show that it execute with the file name was not an executable.

Dave Kreskowiak 20-Jan-21 23:18pm

The only way to get a virus to execute is to launch it as code. Scanning it with a virus scanner will NOT do that. Copying the file into a database will NOT do that. Just reading the file will NOT do that.

It MUST be specifically loaded as code and executed. Now, if your machine is already infected with the virus, it's already running as part of the system, hooked into I/O functions in Windows, which CAN infect files and spread the virus without you knowing it, just by reading them.

Seriously, wipe the machine and start from scratch. Next time you want to play with a virus, ALWAYS do it in a virtual machine. The virus running in on virtual machine cannot impact or infect the host machine.

Abraham Tinonahon silitonga 21-Jan-21 4:32am

How about the thing that i heard about anti-vm? What about it?

Abraham Tinonahon silitonga 21-Jan-21 4:34am

And also, i will start it from scratch and reinstall it as soon as my kaspersky license expires. Which is in 28/11/2021.

Abraham Tinonahon silitonga 21-Jan-21 4:38am

Because i don't know if my kaspersky account saves my license so i tried to save my files and try to reinstall windows and use the cloud installation option. By the way, i don't really know how dangerous a Visual Basic Virus is. I think that the virus should not have any related things with the main system like the CMOS memory and the BIOS.

Abraham Tinonahon silitonga 21-Jan-21 4:47am

Oh ya, by the way. I belive that the virus has vanished. Because like i say in the comments. I try to scan it but nothing suspisious is happening. So it will not copy itself into a drive or a usb.