How to recover files from virus attack part 1
One day a friend came asking for our help. He uses Microsoft Windows XP operating system. Suddenly lots of his files became some sort of “.bmp” files. And those files can be viewed, but they’re really not a nice picture. We’re it was somekind of virus attack. We started to plan a strategy.
- Get the newest update for the anti virus definition and database
- Recover infected files
First we must know, which process/server are running in this machine. We can use ‘tasklist‘ and ‘service.msc‘ commands for this.
We typed “tasklist” first on the command prompt.
c:\tasklist
The screen displayed a suspicious service named “kspool.exe”. Next we called the “service.msc”.
C:\service.msc
The result was the same. We tried to stop this service and …it started again automatically :). Then we checked the dependency of “kspool.exe”. Ooops it’s used by ‘explorer.exe‘.
To kill ‘kspool.exe‘ process we must kill its parent process first - that’s the ‘explorer.exe‘ process. Using “CTR+ALT+DEL” we killed the explorer process and then we proceed to stop the kspool process. Everything works fine then.
File recovery can be started normally, but we thought it’s not a good option. The virus was still there, so we must erase it first. We started the explorer services again.
c:\explorer
Using Windows Explorer we found ‘kspool.exe‘ in the system32 folder. We deleted the file (but not after we copied it to our flash disk for later research ;).
The virus has been erased, then we proceed to check the registry to find the key contains the ‘kspool.exe‘ string.
We found it in :
“HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run”
“HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run”
The description says “kernel spool”. That’s old trick. We deleted it.
Time to recover lost or infected files. We recommend Recover My Files, DOC Regenerator for broken .DOC files, and XLS Regenerator for broken .XLS files. And again don’t forget to update anti virus definition and database.