How To Remove Virus Shortcuts
This virus can be classified as this one was a smart virus, some antivirus that cannot detect this virus. This is because the virus does not attack the system from our computer, but only doubles the folders in our hard drive. This virus can easily see its existence in our computer
to remove this virus from the manual way which is very complicated and long, I recommend installing antivirus avira, because this virus is able to detect the presence of this virus, besides avira avg and norton also can detect it.
click here to download avira, after download the master files also do not forget to download updates. to update files can bedownloaded here. do not forget your turn off system restore when you scan your system.
but that’s not enough help, because we probably AV block by the virus was, therefore, follow this 6 steps to remove it :
1. turn off system restore.
2. Turn off the process of Wscript file located in C: \ Windows \ System32, by using tools such as CProcess, HijackThis or can also use the Windows Task Manager.
3. Once off the process of Wscript, we need to delete or to rename the file so as not to be used temporarily by the virus.
4. Delete an existing parent file in C: \ Documents and Settings \ \ My Documents \ database.mdb, so that every time the computer starts will not load the file. And do not forget we are also open MSCONFIG, disable the run command.
5. Now we are going to delete the file autorun.inf file. Microsoft.INF and Thumb.db. click the START button, type CMD, moved to the drive to be cleaned, for example drive C: \, then we should do is:
Type C: \ del Microsoft.inf / s, this command will be to delete all microsoft.inf files in all folders on drive C:.
6. Fix your registry that has been modified by a virus. To expedite the repair process registry copy the script below on the programs ‘notepad’ and save with the name ‘repair.inf’. Run the file by:
- Right Click repair.inf
- Click Install
script:
[Version] Signature=”$Chicago$” Provider=Vaksincom Oyee [DefaultInstall] AddReg=UnhookRegKey DelReg=del [UnhookRegKey] HKLM, Software\CLASSES\batfile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\comfile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\exefile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\piffile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1?” HKLM, Software\CLASSES\scrfile\shell\open\command,,,”””%1?” %*” HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe” HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe” HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe” [del] HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Winupdate
This virus can be classified as this one was a smart virus, some antivirus that cannot detect this virus. This is because the virus does not attack the system from our computer, but only doubles the folders in our hard drive. This virus can easily see its existence in our computer
to remove this virus from the manual way which is very complicated and long, I recommend installing antivirus avira, because this virus is able to detect the presence of this virus, besides avira avg and norton also can detect it.
click here to download avira, after download the master files also do not forget to download updates. to update files can bedownloaded here. do not forget your turn off system restore when you scan your system.
but that’s not enough help, because we probably AV block by the virus was, therefore, follow this 6 steps to remove it :
1. turn off system restore.
2. Turn off the process of Wscript file located in C: \ Windows \ System32, by using tools such as CProcess, HijackThis or can also use the Windows Task Manager.
3. Once off the process of Wscript, we need to delete or to rename the file so as not to be used temporarily by the virus.
4. Delete an existing parent file in C: \ Documents and Settings \ \ My Documents \ database.mdb, so that every time the computer starts will not load the file. And do not forget we are also open MSCONFIG, disable the run command.
5. Now we are going to delete the file autorun.inf file. Microsoft.INF and Thumb.db. click the START button, type CMD, moved to the drive to be cleaned, for example drive C: \, then we should do is:
Type C: \ del Microsoft.inf / s, this command will be to delete all microsoft.inf files in all folders on drive C:.
6. Fix your registry that has been modified by a virus. To expedite the repair process registry copy the script below on the programs ‘notepad’ and save with the name ‘repair.inf’. Run the file by:
- Right Click repair.inf
- Click Install
script:
[Version] Signature=”$Chicago$” Provider=Vaksincom Oyee [DefaultInstall] AddReg=UnhookRegKey DelReg=del [UnhookRegKey] HKLM, Software\CLASSES\batfile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\comfile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\exefile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\piffile\shell\open\command,,,”””%1?” %*” HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1?” HKLM, Software\CLASSES\scrfile\shell\open\command,,,”””%1?” %*” HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe” HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe” HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe” [del] HKLM,SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Winupdate
HKCU,SOFTWARE\Microsoft\Windows\CurrentVersion\Run, explorer
0 comments:
Post a Comment