How to Remove a File Virus

Is it a Companion Virus?
Before You Clean a File virus, Learn More
Back it up
Test Cleaning on Your Backup Copies
If Your Scanner Claims it Can Remove the Virus
If Your Scanner Claims the Virus is Not Removable
When You are Ready to Clean...

Is it a Companion Virus?

Companion viruses can be removed manually and completely, with no damage to your system. Simply traverse directories, starting at the root, and look for all COM files having a corresponding EXE file in the same directory, where the COM file is the size of the virus. Then delete the COM file.

For instance, if your system as the AIDS II virus, and you find a file named "ABC. COM" and "ABC. EXE" in a directory, and ABC.COM file is 8064 bytes, then ABC. COM is the virus. Simply delete ABC. COM.

Before You Clean a File virus, Learn More

Look up the virus in V-Base.

What file types does it infect? Does it overwrite (making it unremovable)? Does it encrypt (if part of the file is encrypted, removal is less likely.)

Is it stealth? Does it have other properties that might interfere with detection or removal?

How does it spread? (Be sure to avoid this condition when it is in memory!)

Back it up

Copy all infected files to floppy.

Place this disk in A: of an infected machine, and scan it.

Generate a report

Let your scanner generate a report of all infected files.

Print this out, and label the printout with the user name or machine name.

Test Cleaning on Your Backup Copies

Can your product clean it? Testing cleaning is especially important when it comes to file viruses. Most products are nearly adequate when it comes to cleaning boot viruses (though most fail with things like Natas and struggle with viruses such as Monkey, if these viruses are resident.) But cleaning files requires more IQ, and is more perilous. After all, boot sectors are a dime a dozen. Files aren't.

Take the diskette to a clean machine. Scan. If a virus is found, permit it to clean. Now scan again. Is it still infected? Some products (e.g., CPAV) will stop before cleaning all files. Others may only remove a portion of the virus code.

If it is no longer infected, are programs still usable?

Record file sizes. COM files should generally be the same size now as corresponding uninfected COM files. EXE files should generally be no more than 15 bytes larger. No program should be smaller after cleaning than a copy that has never been infected.

Run each program. If any hang the machine or display garbage, your product has likely damaged the file.

If cleaning is imperfect, and the virus is theoretically removable, get a new product and repeat this test cleaning before proceeding.

If Your Scanner Claims it Can Remove the Virus

Resist all temptation here and don't let the scanner remove it -- not just yet. It's one thing to have an anti-virus product remove a virus and leave you with a damaged file, and it's another for the scanner to remove the virus and leave you with a program that runs. The difference between the two is perfect identification. For a scanner to perfectly remove a virus, it must know two things: exactly which virus this is and how to remove this particular virus. Since most scanners don't do perfect identification, you must do some experimenting:

- if the scanner can rename the file(s), let it
- if the scanner can't rename the file(s), copy down the filename(s) and rename it manually
- copy the renamed file to a floppy
- let the scanner remove the virus from the copy on the floppy
- test the results:

- is the file smaller than it was originally? If it is, the file is damaged. You'll have to restore from a backup. But before you do, make sure that the backup copy isn't infected, too.
- does the file still run? If not, you'll have to restore from an uninfected backup
- does another scanner report a problem with this file? If the second scanner finds part of the virus still in the program you tried to remove the virus from, you'll be haunted until you replace from backups. Proper removal won't leave any virus bytes in your cleaned file.
- learn more about the virus. Look it up in V-Base -- it will describe what the virus does, what it targets, how it infects, etc.

If Your Scanner Claims the Virus is Not Removable

If your scanner claims the virus isn't removable, it may be lying. But it may not, so get out your labcoat and start experimenting:

- get another scanner and repeat the scan. Do this until you find a scanner that can remove the virus. If you find one, go back and read the previous section.
- if you can't find another scanner that can remove this virus, you'll have to delete the file and restore from an uninfected backup.
- learn more about the virus in V-Base. Get clues on which other files it might have infected and how.

If the infection is on your server, you may be tempted to down the server right away. This will usually be counterproductive, since you won't be able to do anything until it's back up. Here are some suggestions for what to do:

- terminate all user connections from the server after a warning, ensuring that users are able to close files that are open and exit in an orderly way.
- run your best scanner against the server from a workstation, letting it automatically rename all infected files it finds, and generating a log file. You will need to login as Supervisor or Administrator to scan everything. You might want to leave this product running non-stop, until everything has calmed down.
- replace these infected files from your backup tape, and scan again. Repeat using an older backup, if any restored files are infected. If you cannot find uninfected backup copies, then use your anti-virus product to remove the virus from the remaining infected (renamed) files. Be sure to save one or two copies of the virus, for later analysis.
- modify the master login script so that all users will have their local drives scanned when they login. This setup should ideally generate a report for each user, which includes their login name. Someone can review the reports to see which users are/were infected.
- check who has had permission to access the infected files. One or more of these users is quite likely infected, if they ran any of these files in the last few days. The infection may be in their workstation's memory, ready to re-infect when they login again. Get down to their offices, and get somebody busy checking their machine and all suspect floppies (any disk that has been in their machine since the infection was introduced).
- look up accurate information about this virus in an information database such as V-Base. What you learn might be very helpful in dealing with the virus or with concerned users and management.
- don't forget to notify your supervisor about the problem, and to keep her posted.
- after all copies of the virus have been killed off, restructure files on the server so that they cannot be infected. In some network operating systems, you may be able to mark executables as "execute" or "execute only". In most, you can deny write permission at the directory level to any directories housing executables. In NetWare, your goal will be to not have any executable programs in any directory where any user has write permission.
- if the infection resurfaces (most do), you may need to install anti-virus TSRs or device drivers in local machines, and an anti-virus NLM on each server.

When You are Ready to Clean...

If the machine can be safely scanned and the virus safely removed while in memory...

- Add your command-line scanner/remover to the network login script, so that all users are scanned/cleaned when they login. Options to choose: files that this virus can infect (if file infector), no memory scan.

If the machine cannot be safely scanned with the virus in memory...

- Set login script to scan a non-existent file in root of C:, also scan memory. Exit with errorlevel. If errorlevel then TYPE WARNING.DOC, PAUSE, Warning should display message asking user to call you, and exit without logging in.

The scanner must be stored in a directory in which no user (other than supervisor) has write permission.