MERGED: aikelyu virus

[JRanes]

---

Ei,..thank you guys..!!! it works for me...na erase na ang virus..! yeheee....! salmat sa procedure "Chipmunk888".... :mrgreen: try nq install Kaspersky ron..

[cathy violet]

guys kainis jd! i'm trying to remove this virus from my laptop by doing the del c:\autorun.* /f/s/q/a thing, bt it says man na "could not find c:\autorun.*" what should i do man?
help pls...

[JRanes]

bay! mao na imo virus aikelyu.html? f kna...i think mk relate k ani..ana sad aq virus yestrday..follow ha lng ni..gkan rni sa ng tabang nq dri...

Files to be deleted:

> kernel.dll.vbs & aikelyu.html { C:\WINDOWS\system32 }
> pooh.vbs & autorun.inf { C:\, D:\, E:\ or all available root drives }


Detailed Kill:

> Run "taskmgr", in the Processes(tab), End Process all instances of "wscript.exe" from the Task manager
> Run "cmd", type "cd\" press enter, type "cd windows\system32" press enter
> type "attrib -h -s -r kernel.dll.vbs" press enter, type "del kernel.dll.vbs" press enter
:same process when deleting aikelyu.html
> now go to drive root, by typing "cd\" press enter
> type "attrib -h -s -r pooh.vbs" press enter, type "del pooh.vbs" press enter
:same process when deleting autorun.inf
> Do the same process from each drive root when deleting pooh.vbs and autorun.inf

Registry Changes:

> Path: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
- Find Shell(String Value), modify its value to "Explorer.exe"
- Remove this ->"C:\WINDOWS\system32\kernel.dll.vbs", you can see it is added to the Shell(String value)

> Path: "HKLM\software\Microsoft\Windows\CurrentVersion\Ru n\aikelyu"
- Delete aikelyu.html

Restart and Done.

[timmyduncan]

daghan na au makita na solutions ani na virus sa internet....

[Chipmunk888]

Ei,..thank you guys..!!! it works for me...na erase na ang virus..! yeheee....! salmat sa procedure "Chipmunk888".... :mrgreen: try nq install Kaspersky ron..

good to hear that. welcome.

[marietse]

hello... puede ko mangayo ug specific steps sa pagdelete ani na virus

[iskoLares]

@marietse... pls scroll up

[netravali]

naay tool para tangtang ana... e search lang sa google... naka download ko para tangtang ana ..... AIKELYU REMOVAL TOOL e type

[kantapol]

i think that that was not perfectly done yet... i tried that and it was effective but there
is still to be changed in Registry Editor. like the when you double click the drive d: in my
comuter, it stil looks for the pooh.vbs file. Even though we already deleted it, it was still
configured to look for pooh.vbs rather than displaying the files of drive c: or wahtever
drive you double clicked.

i was able to locate where it in
HKEY_USERS\S-1-5-21-73586283-1202660629-1708537768-1003\Software\Microsoft\
Windows\CurrentVersion\Explorer\MountPoi

as u enter here, the following folders here that alphanumerical which has folder like
Shell\AutoRun\command

in here, the "(Default)" has been modified to open that pooh.vbs
i think it is in here to be modify so that when you double click a certain drive
it will view its files.

hope i was good enough to explain to you my problem.

I am looking forward that you can help me in this one...

[kantapol]

i think that that was not perfectly done yet... i tried that and it was effective but there
is still to be changed in Registry Editor. like the when you double click the drive d: in my
comuter, it stil looks for the pooh.vbs file. Even though we already deleted it, it was still
configured to look for pooh.vbs rather than displaying the files of drive c: or wahtever drive you double clicked.

i was able to locate where it in
HKEY_USERS\S-1-5-21-73586283-1202660629-1708537768-1003\Software\Microsoft\
Windows\CurrentVersion\Explorer\MountPoi

as u enter here, the following folders here that alphanumerical which has folder like
Shell\AutoRun\command

in here, the "(Default)" has been modified to open that pooh.vbs
i think it is in here to be modify so that when you double click a certain drive
it will view its files.

hope i was good enough to explain to you my problem.

I am looking forward that you can help me in this one...