How to get rid of TAGA LIPA ARE! in your IE...

[DuaneKier]

---

How to Remove “FS6519.dll.vbs” or If you Have “TAGA LIPA ARE!” in your IE

March 18th, 2007 at 2:11 am (Troubleshooting)

Symptoms: C: drive has an [autoplay] function when right-clicked. Internet Explorer has “TAGA LIPA ARE!” in it’s title bar.

Mode of Transfer: USB, Fixed/Portable HDD

Target: Internet Explorer, Registry, MSConfig, Autorun.inf

Effects: Every Mass Storage Device linked to the infected PC will be inserted with an autorun file which will trigger the Windows Scripting Service to run its main file “FS6519.dll.vbs”, which is marked as a system file and is in the root directory of the Drive.

Open My Computer -> Tools Menu -> Folder Options -> View Tab:

Select: Show hidden Files and Folders

Uncheck: Hide Extensions for known file type and Hide Protected operating system

Click Yes Then OK.

You will see an autorun.inf and FS6519.dll.vbs in all your harddrives. Delete ALL of them.

If it says that something is using the program. Press Ctrl+Alt+Del and go to processes, end ALL wscript.exe

Open MSConfig and under startup, uncheck the trojan’s startup entry, [FS6519].

Click Start > Run and then type regedit

delete [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run\FS6519] key, and modify [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title”,”TAGA LIPA ARE!”] key to remove the nuisance in IExplorer.

OR go to Edit -> Find and type FS6519.dll.vbs.

Edit the found registry by selecting the name, ryt click and modify, remove the last two strings which is wscript.exe and FS6519.dll.vbs and click OK.

If finished, press F3 and it will search again for another, just do the same thing until nothing is found in your registry.

If you are done with the FS6519.dll.vbs, its time for the TAGA LIPA ARE! be edited in your IE, type the string on the search again then it will show up the IE title … modify then type anything you like or better delete it.

Have a Nice FREE Virus Trojan Day!!!

[eax]

Try using firefox

[mindless]

@DuaneKier

nice tips.. thanks.

[isone]

@Duanekier

lamats it helps jud ....pero boss ask lang ko if na remove nato sya sa registry naa ba possibility na mobalik to sya ?

[yatakitumbi]

kung ako ana reformat HD...start all over again...hehehe...

[erwin_rommel]

how about kanang mu kalit og tunga sa desktop nga same.scr og preset bro, naa ka idea unsaun nga dili na mu gawas balik?

[isone]

kung ako ana reformat HD...start all over again...hehehe...

mao lige hasol na sad kaau sad hinoon .. kai back to scratch na sad ka

[daqs]

used OPERA 9.02 browser. TAGA LIPA ARE is a VB script virus and it pretends it self as a windows file. try install original anti virus , it works for me, try bitdefender 10. naa sa cbx. 700 + ang price..

[pnoize]

another local virus. this time made by a batangueño. TAGA LIPA ARE literally means I'm from Lipa (Lipa, Batangas).

[isone]

another local virus. this time made by a batangueño. TAGA LIPA ARE literally means I'm from Lipa (Lipa, Batangas).

you mean this is made locally by our fellow kababyan ... ow nice pud iyang script kai makaguba jud ... hahah