If you would like to pay for your virus removal, try McAfee Virus Removal Service, or a more afforable alternative PcCare.com Step 1 Step 2 Boot infected system from the PE cdrom. Step 3 Create a list of unsigned executable files, list includes files which are executable but are not named with .exe extension. sigcheck -u -e -a -s c:\ > c:\temp\sigcheck.txt Extact filenames for later comparison. type c:\temp\sigcheck.txt | find "c:\\" | sort > c:\temp\sigcheckFiles.txt Step 4 Remove PE cdrom and boot system into normal mode. Re-run above command to determine files modified by virus. sigcheck -u -e -a -s c:\ > c:\temp\sigcheckVirus.txt type c:\temp\sigcheckVirus.txt | find "c:\\" | sort > c:\temp\sigcheckVirusFiles.txt Copy sigcheck files to non-infected system containing an installed copy of the resource kit ( Vista , Xp ). Compare sigcheckVirusFiles.txt and sigcheckFiles.txt with windiff. The diffs are files hidden/modified by the virus. |