driveguard.exe virus

Removal of Driveguard.exe virus is very easy. just open taskmanager and end the process driveguard.exe and also of any .tmp extension is running then also end that process. Now remove its entry from startup by going to msconfig. also dont forget to del your temp files.

How i found it:
Today one of my frnd came to me for some files from my system.. he inserted his pen drive and clicked here ..there... result: pc got infected

i found the process driveguard . exe in task manager

it was trying to access site
http://www.freewebs.com/microsotf/
and download some Update-KB684903-x86. exe file..
http://rapidshare.com/files/127625927/Update-KB684903-x86.rar.html

which was detected by nod as a trojan

the site is still alive as the admins of freewebs are damn lazy to take actions

download link for driveguard file
http://rapidshare.com/files/127625326/WinDriveGuard.rar.html

read the text file.. it claims it to be "spyware removal tool"

removing virus manually

Virus Problems..

common symptoms..

1.folder options will not be visible

2.taskmanager disabled

3.regedit disabled

4.on double clicking on any window.. it will open in new window even if your settings are correct

etc etc..

HOW TO REMOVE VIRUS MANUALLY.

Tools required

1.restriction removal tool

link: http://www.softpedia.com/get/Security/Security-Related/RRT-Remove-Ristrictions-Tool.shtml

http://www.esnips.com/doc/c90f7814-42e8-4586-bc4e-4140696e8fc7/RRT

2.unhackme

http://www.greatis.com/unhackme/download.htm

3.hijackthis

http://www.esnips.com/doc/83f6253f-00a5-4763-bd59-8252244158fd/hijackthis_sfx

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

4.process explorer

from microsoft site

If your pc is affected with some virus the most common of all is your folder otion will be disabled,you may not be able to open task manager, etc etc..

now 1st step is to identify the virus process

process explorer will help u and u may see the path of the installed file on ur system

now use restriction removal tool to remove the task bar ..folder option restrictions...etc...

now our aim is to remove the running virus process..

use hijackthis and select the virus process. it will remove the process from startup registry also..

finally try unhackme.. to remove the rootkits

many virus can be removed in this way but many still remain on ur pc.. in such situations.. try to google for its removal methods manually.. once the restrictions are removed u may be able to use taskmanager and able to use regedit command

Restriction Removal Tool [RRT]

Simple to Use

Just click on restriction

and after selecting them click on "Check All"

Hijack This

Its used to remove the entries of the process from registry.

You may use this to view all the running process and their path.

Just scan once..mark the ones to be deleted and then click on "fix checked"

if you wish you may save the log file also

I think i have give useful information about removing viruses manually from your system

still if you find some problem you are free to contact me either through my communities

1.Hacking and Virus Writing [http://www.orkut.com/Community.aspx?cmm=26828468]

2.Virus Writing [http://www.orkut.com/Community.aspx?cmm=1450780]

or through mail.

egunda@gmail.com

Apple & PC at One Desk

Apple & PC together (-: