MERGED: aikelyu virus

[JRanes]

---

elow..cn i ask anybodys opinion how to fix this kind of virus "pooh.vbs"? ano anti-virus e installed q..bitDefender hndi ma dtect.

[erwin_rommel]

ma delete man ni cya og mano2x. i enable lang ang view system files and folders og hidden files. then ayaw i double click ang imong drive, i explore lang kay mu autorun ni cya then dili na nimo ma delete og mano2x, kinahanglan na pud ni nimo i restart. then if ma view na nimo ang hidden og system files, luk 4 the .vbs file og iyang autorun unya delete it manually

[JRanes]

ang pg enable sa system files is to open the windows folder\system? mao b ni? wat kha ang particular filename sa iya autorun? mao ning .inf? whr kha mostly ma locate ning virus.sa? kta nq ani sa usb aq g delete pero balik ra ghapon...

[erwin_rommel]

ang pg enable sa system files is to open the windows folder\system? mao b ni? wat kha ang particular filename sa iya autorun? mao ning .inf? whr kha mostly ma locate ning virus.sa? kta nq ani sa usb aq g delete pero balik ra ghapon...

ad2 sa my computer/tools/view/ unya show hidden files and folders og uncheck ang hide system files
usually naa na sa mga drives. first, i delete ang naa sa drive c kay mu balik2x na cya if dili nimo ma delete the check each drive and delete those files

[JRanes]

now nk open nq sa drive C og drive d ala nay mo dsplay nga error na delete nmn nq ang autorun..aq nlng is..naay cge pop.up kda on nq sa pc mao ni ang url: file:///C:/WINDOWS/system32/aikelyu.html k knw k ani? virus ghapon ni?

[Blah-Blah]

virus na xa.. try searching diri kung unsaon pag tangtang

[erwin_rommel]

now nk open nq sa drive C og drive d ala nay mo dsplay nga error na delete nmn nq ang autorun..aq nlng is..naay cge pop.up kda on nq sa pc mao ni ang url: file:///C:/WINDOWS/system32/aikelyu.html k knw k ani? virus ghapon ni?

imu sigurong gi double click pag sulod nimo sa drive. once imo nang i double click, mu run man ang program, ang result, dili nimo ma delete. nig open nimo ayaw i double click but right click then explore

[JRanes]

saon mn ni pg remove ning virusa? file:///C:/WINDOWS/system32/aikelyu.html , tapos nmn nq na remove tong Pooh.vbs same rb kha ni cla nga virus?

[box2joe]

delete rana mano mano bro! sunda lang ang path ///C:/WINDOWS/system32/aikelyu.html
or copy e copy paste sa imo explorer tab para diretso ka sa system location then dellete dayon once makita na nimo ang file as what erwin_rommel said ayaw e double click imo hardrive just use explore to access.

by the way next time use kaspersky para dili na kana makasulod sa imo system.

[Chipmunk888]

^_^ i had fun removing this toy before.


Here you go...

Files to be deleted:

> kernel.dll.vbs & aikelyu.html { C:\WINDOWS\system32 }
> pooh.vbs & autorun.inf { C:\, D:\, E:\ or all available root drives }


Detailed Kill:

> Run "taskmgr", in the Processes(tab), End Process all instances of "wscript.exe" from the Task manager
> Run "cmd", type "cd\" press enter, type "cd windows\system32" press enter
> type "attrib -h -s -r kernel.dll.vbs" press enter, type "del kernel.dll.vbs" press enter
:same process when deleting aikelyu.html
> now go to drive root, by typing "cd\" press enter
> type "attrib -h -s -r pooh.vbs" press enter, type "del pooh.vbs" press enter
:same process when deleting autorun.inf
> Do the same process from each drive root when deleting pooh.vbs and autorun.inf

Registry Changes:

> Path: "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
- Find Shell(String Value), modify its value to "Explorer.exe"
- Remove this ->"C:\WINDOWS\system32\kernel.dll.vbs", you can see it is added to the Shell(String value)

> Path: "HKLM\software\Microsoft\Windows\CurrentVersion\Ru n\aikelyu"
- Delete aikelyu.html

Restart and Done.



My claps to quickie =)