Using command prompt "attrib" to check for Viruses or Malware

Microsoft Command Prompt "attrib" is a very useful tool to check if your hard drives even your flashdisks have been infected by a virus.
You will know if a Malware is inside your hard drive just by looking at the attributes of each files and the file that has the attributes of +s +h +r


The function of attrib is to set and remove file attributes (read-only, archive,system and hidden).


Launch attrib

To start attrib

1. Go to Start Menu > Run
2. Type cmd (cmd stands for command prompt)
3. Press Enter key

The Command Prompt will appear showing us where is our location in the directory.






Using attrib

To use attrib

1. Go to the root directory first by typing cd\(because this is always the target of Malware / Virus)

2. Type attrib and press Enter key

• Benefits of Rooting your Android PhoneI recently purchased an HTC Wildfire phone and I must say this is one of the coolest phone (in terms of budget and features) out there.. - 3 months ago
• Spanish Galleon AndaluciaThe Spanish Galleon Andalucia visited the beautiful island of bohol from October 23-26,2010. -11 months ago
• Uchiha Sasuke Team HebiHebi (means snake) is a group of specialized shinobi created by Uchiha Sasuke having one goal in mind, and that is to kill his brother Uchiha Itachi. - 11 months ago

In this example, I have two files that are considered as malware.

Note that there are two files which I outlined in red (SilentSoftech.exe and autorun.inf). Since you cannot see this file nor delete it (because the attributes that was set on these files are +s +h +r)

1. +s - meaning it is a system file (which also means that you cannot delete it just by using the delete command)
2. +h - means it is hidden (so you cannot delete it)
3. +r - means it is a read only file ( which also means that you cannot delete it just by using the delete command)

Now we need to set the attributes of autorun.inf to -s -h -r (so that we can manually delete it)

1. Type attrib -s -h -r autorun.inf ( be sure to include -s -h -r because you cannot change the attributes using only -s or -h or -r alone)
2. Type attrib again to check if your changes have been commited
3. If the autorun.inf file has no more attributes, you can now delete it by typingdel autorun.inf
4. Since SilentSoftech.exe is a malware you can remove its attributes by doing step 1 and step 3(just change the filename) ex. attrib -s -h -r silentsoftech.exe

There you have it!!!!
NOTE : when autorun.inf keeps coming back even if you already deleted it, be sure to check your Task Manager by pressing CTRL + ALT + DELETE ( a virus is still running as a process thats why you cannot delete it. KILL the process first byselecting it and clicking End Process.
NOTE: You can also apply the attrib -s -h -r command to all the partition of your computer, drive D: drive E: drive F: (all of your drives). For example. for drive D, just type "D:" (minus the double quote) then you can see that your current drive is D.. type there the command "attrib -s -h -r *.exe" for exe files and "attrib -s -h -r *.inf" and then delete the file by "del autorun.inf".
Hope this helps!!!!! 🙂

[h=1]Attrib[/h]
Displays, sets, or removes the read-only, archive, system, and hidden attributes assigned to files or directories. Used without parameters, attrib displays attributes of all files in the current directory.
[h=2]Syntax[/h]attrib [{+r|-r}] [{+a|-a}] [{+s|-s}] [{+h|-h}] [[Drive:][Path] FileName] [/s[/d]]

Top of page
[h=2]Parameters[/h]+r: Sets the read-only file attribute.
-r : Clears the read-only file attribute.
+a : Sets the archive file attribute.
-a : Clears the archive file attribute.
+s : Sets the system file attribute.
-s : Clears the system file attribute.
+h : Sets the hidden file attribute.
-h : Clears the hidden file attribute.
[Drive:][Path] FileName: Specifies the location and name of the directory, file, or set of files for which you want to display or change attributes. You can use wildcard characters (that is, ? and *) in the FileName parameter to display or change the attributes for a group of files.
/s: Applies attrib and any command-line options to matching files in the current directory and all of its subdirectories.
/d: Applies attrib and any command-line options to directories.
/?: Displays help at the command prompt.

Top of page
[h=2]Remarks[/h]

Top of page
[h=2]Examples[/h]To display the attributes of a file named News86 located on the current drive, type:
attrib news86
To assign the read-only attribute to the file named Report.txt, type:
attrib +r report.txt
To remove the read-only attribute from files in the \Public\Jones directory on a disk in drive B and from files in any subdirectories of \Public\Jones, type:
attrib -r b:\public\jones\*.* /s
Consider a scenario where you want to give an associate a disk containing all files in the default directory on a disk in drive A, except files with the .bak extension. Because you can use xcopy to copy only those files marked with the archive attribute, you need to set the archive attribute for those files you want to copy. First, you need to set the archive attribute for all files on drive A. Second, you need to clear the archive attribute for those files with the .bak extension. For example, type:
attrib +a a:*.* attrib -a a:*.bak
Next, use xcopy to copy the files from the disk in drive A to the disk in drive B. The /a command-line option in the following command causes xcopy to copy only those files marked with the archive attribute. For example, type:
xcopy a: b: /a
If you want xcopy to clear each file's archive attribute after it copies the files, use the /m command-line option instead of /a. For example, type:
xcopy a: b: /m

Top of page
[h=2]Formatting legend[/h][TABLE="class: dataTable, width: 1"]
[TR="class: stdHeader, bgcolor: #99CCFF"]
[TD]Format[/TD]
[TD]Meaning[/TD]
[/TR]
[TR="class: record"]
[TD]Italic
[/TD]
[TD]Information that the user must supply
[/TD]
[/TR]
[TR="class: evenRecord, bgcolor: #E9E9E6"]
[TD]Bold
[/TD]
[TD]Elements that the user must type exactly as shown
[/TD]
[/TR]
[TR="class: record"]
[TD]Ellipsis (...)
[/TD]
[TD]Parameter that can be repeated several times in a command line
[/TD]
[/TR]
[TR="class: evenRecord, bgcolor: #E9E9E6"]
[TD]Between brackets ([])
[/TD]
[TD]Optional items
[/TD]
[/TR]
[TR="class: record"]
[TD]Between braces ({}); choices separated by pipe (|). Example: {even|odd}
[/TD]
[TD]Set of choices from which the user must choose only one
[/TD]
[/TR]
[TR="class: evenRecord, bgcolor: #E9E9E6"]
[TD]Courier font
[/TD]
[TD]Code or program output
[/TD]
[/TR]
[/TABLE]

Command-line reference A-Z

Thanx for the info:

Using Chkdsk

Creates and displays a status report for the disk. The chkdsk command also lists and corrects errors on the disk.
The chkdsk command with the parameters listed below is only available when you are using the Recovery Console The chkdsk command with different parameters is available from the command prompt.

chkdsk [drive:] [/p] [/r]

Parameters
none
Used without parameters, chkdsk displays the status of the disk in the current drive.
drive :
Specifies the drive that you want chkdsk to check.
/p
Performs an exhaustive check even if the drive is not marked for chkdsk to run. This parameter does not make any changes to the drive.
/r
Locates bad sectors and recovers readable information. Implies /p.
Note

• The chkdsk command requires the file Autochk.exe. If it cannot find it in the startup directory (\%systemroot%\System32, by default), it will attempt to locate it on the Windows Installation CD. If you have a multiboot computer, be sure you are issuing this command from the drive containing Windows.

Asanteni.

How to remove Bar311.exe Shuts down a PC Virus


I was plagued by this virus once in our Computer Laboratory and searching google was my first option... i searched google but solutions are vague or incomplete but I finally managed to find the correct solution.
so, I would like to share it to you hoping that this will aid you in vanquishing bar311..









Symptoms when infected by Bar311.exe or Winzip123

The virus comprises bar311.exe, password_viewer.exe, photos.zip.exe and pc-off.bat.
When you boot your Windows XP in Safe Mode the message appears: Thank You!!! Password:Winzip123
The pc-off.bat contains the syntax like this"C:/path/shutdown -s -f -t 2 -c" which automatically shutdown your computer when you run the cmd.exe.


Manual Removal of Bar311.exe

1. Go to Task Manager by pressing CTRL+ALT+DEL then kill (end process) password_viewer.exe or bar311.exe or photos.zip.exe...
2. EDIT the following registry entries thru Regedit


How to access Regedit?

1. Go to Start Menu > Run
2. Type Regedit and Press Enter key

Just follow the directory and click the folder...[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="userinit.exe,bar311.exe" -> remove ", bar311.exe" only...
>leave userinit.exe because this is used by Windows when you log-in...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001

HKEY_CURRENT_USER\Software\Microsoft\Command Processor] "autorun"="c:\Windows\pc-off.bat" -> remove "c:\Windows\pc-off.bat" or delete the autorun key.

3. go to your thumb drive, please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe
4. open notepad then type what is shown below as is...

@echo off del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause




then save this as remove.bat then double click to run


Hope this helps!!!!

MziziMkavu said:

How to remove Bar311.exe Shuts down a PC Virus


I was plagued by this virus once in our Computer Laboratory and searching google was my first option... i searched google but solutions are vague or incomplete but I finally managed to find the correct solution.
so, I would like to share it to you hoping that this will aid you in vanquishing bar311..









Symptoms when infected by Bar311.exe or Winzip123

The virus comprises bar311.exe, password_viewer.exe, photos.zip.exe and pc-off.bat.
When you boot your Windows XP in Safe Mode the message appears: Thank You!!! Password:Winzip123
The pc-off.bat contains the syntax like this"C:/path/shutdown -s -f -t 2 -c" which automatically shutdown your computer when you run the cmd.exe.


Manual Removal of Bar311.exe

1. Go to Task Manager by pressing CTRL+ALT+DEL then kill (end process) password_viewer.exe or bar311.exe or photos.zip.exe...
2. EDIT the following registry entries thru Regedit


How to access Regedit?

1. Go to Start Menu > Run
2. Type Regedit and Press Enter key

Just follow the directory and click the folder...[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="userinit.exe,bar311.exe" -> remove ", bar311.exe" only...
>leave userinit.exe because this is used by Windows when you log-in...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\ CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
"HideFileExt"=dword:00000000
"ShowSuperHidden"=dword:00000001

HKEY_CURRENT_USER\Software\Microsoft\Command Processor] "autorun"="c:\Windows\pc-off.bat" -> remove "c:\Windows\pc-off.bat" or delete the autorun key.

3. go to your thumb drive, please use the folders view in the explorer and use the navigation panel on the left side when accessing the drives to avoid triggering the autorun... then delete autorun.inf and password_viewer.exe or bar311.exe
4. open notepad then type what is shown below as is...

@echo off del /a /f c:\Windows\bar311.exe
del /a /f c:\Windows\password_viewer.exe
del /a /f c:\Windows\photos.zip.exe
del /a /f c:\Windows\pc-off.bat
pause




then save this as remove.bat then double click to run

Click to expand...

Hope this helps!!!!

Click to expand...

No, it doesn't help squat!

Kwa nini nikariri mikurasa ishirini ya command line wakati kuna antivirus applications zinazorun hayo ma commandline?

Anheuser said:

No, it doesn't help squat!

Kwa nini nikariri mikurasa ishirini ya command line wakati kuna antivirus applications zinazorun hayo ma commandline?

Click to expand...

Kuna Antivirus nyingi haziwezi kuondowa Virus. kwa mfano kamamunapata messege hii
(Error Message: "Task Manager has been disabled by your administrator" ) hakuna Anti-Virus ikaweza kuiondowa hiyo Virus iliyozuia Task Manager isiweze kufanya kazi je waweza kuiondowa hiyo virus? nikutumie?