aikelyu virus... unsaon pag tang tang?

[potter_2005]

---

thanks sa inyo responce.... na wagtang na si aikelyu na virus...

[circles122345]

try use kaspersky or avg pro... tang tang lage..duha gamita nga anti..

[ryan22]

na sulbad nani? i had the same virus about 2 days ago karon lng pud nko nasulbad...

i got it from my bro's usb flash drive, i've scanned using kaspersky & counterspy more than 10x pero dili jud cya ma detect...

but alas i found a way to kill it....

Download startup control Panel at mlin.net (You're going to use this later)

Go to your Task Manager (Ctrl+Alt+Del)
Terminate the Wscipt.exe process
Terminate the Explorer.exe process

Click New Task and Type "cmd" (without the quotes)

type the following in your command prompt

del c:\pooh.vbs /f/s/q/a
del d:\pooh.vbs /f/s/q/a
(include your other drives and USB drives that have been infected)

del c:\autorun.inf
del d:\autorun.inf
(include your other drives and USB drives that have been infected)


del c:\windows\system32\kernell.dll.vbs

del c:\aikelyu.html /f/s/q/a

Use the start-up program from mlin.net to remove aikelyu.html on windows startup

Go to New Task and type "regedit" (without the quotes)

Go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modifythe value in Shell instead of "explorer.exe c:\windows\system32\kernell.dll.vbs" change it to "explorer.exe" only

:mrgreen: :mrgreen: :mrgreen:

[yatakitumbi]

reformat HD...

[potter_2005]

na sulbad nani? i had the same virus about 2 days ago karon lng pud nko nasulbad...

i got it from my bro's usb flash drive, i've scanned using kaspersky & counterspy more than 10x pero dili jud cya ma detect...

but alas i found a way to kill it....

Download startup control Panel at mlin.net (You're going to use this later)

Go to your Task Manager (Ctrl+Alt+Del)
Terminate the Wscipt.exe process
Terminate the Explorer.exe process

Click New Task and Type "cmd" (without the quotes)

type the following in your command prompt

del c:\pooh.vbs /f/s/q/a
del d:\pooh.vbs /f/s/q/a
(include your other drives and USB drives that have been infected)

del c:\autorun.inf
del d:\autorun.inf
(include your other drives and USB drives that have been infected)


del c:\windows\system32\kernell.dll.vbs

del c:\aikelyu.html /f/s/q/a

Use the start-up program from mlin.net to remove aikelyu.html on windows startup

Go to New Task and type "regedit" (without the quotes)

Go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modifythe value in Shell instead of "explorer.exe c:\windows\system32\kernell.dll.vbs" change it to "explorer.exe" only

:mrgreen: :mrgreen: :mrgreen:

ok kaayo ni nga solution... mao ni gibuhat nako... sulbad na ni nga issue last week pa... salamat sa tanan ni tabang.

[sorcyvernie]

mga expert, akong friend nag problema kay ang ilang pc naa virus. AIKELYU VIRUS. murag local man ni siya no? unsaon ni pag tang tang... dili man ma kuha e scan... using avg and norton... mao ni mo gawas sa screen...

Posted: Wed Aug 08, 2007 2:12 pm Post subject: Help aikelyu.html & kernel.dll.vbs

--------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:14:54 PM, on 8/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

tnx

Sunda 2ng gi.ingon ni potter_2005! Sak2 kaayo na! Na ayo man gani ang ako.a! ~_^

[Clypz]

da, di man mag update og antivirus... hihi.. trend micro palang mo, everyday naay update... :P

[ryan22]

da, di man mag update og antivirus... hihi.. trend micro palang mo, everyday naay update... :P

that doesn't mean nga up to date imo anti virus 100% naka protected...

ma virusan mag gani ang mga way internet how much more kadtong naa?!

[circles122345]

that doesn't mean nga up to date imo anti virus 100% naka protected...

ma virusan mag gani ang mga way internet how much more kadtong naa?!

pag LINUx nalang mo gusto dili masudlan virus...hehhe

[sorcyvernie]

You do indeed have some nasties in your log, so let's see what we can do to clean you up.

Please go to Uploadmalware to upload a suspicious file for analysis.

* Enter your username from this forum
* Copy and paste the link to this thread
* Browse for this filename: C:\WINDOWS\system32\wscript.exe
* In the comments, please mention that I asked you to upload this file
* Click on Send File


Repeat this for the following file:

C:\WINDOWS\system32\kernel.dll.vbs

1. Download ComboFix.exe using either of these links:

* bleepingcomputer.com

* techsupportforum.com

2. Double click on combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.