how to remove FS6519.dll.vbs or TTMS1117.dll.vbs or taga lipa

[vladmire]

---

since this the clickest trojan nowadays, im posting a quick guide on how to remove it..
instead of looking for FS6519.dll.vbs or FS6519.vbs, you can search for tracker.vbs
hope this will help...

My Computer -> Tools Menu -> Folder Options -> View Tab:

Select: Show hidden Files and Folders

Uncheck: Hide Extensions for known file type and Hide Protected operating system

Click Yes Then OK.

You will see an autorun.inf and FS6519.dll.vbs or TTMS1117.dll.vbs or taga lipa in all your harddrives. Delete ALL of them.

If it says that something is using the program. Press Ctrl+Alt+Del and go to processes, end ALL wscript.exe

Then go to run type regedit and then press ok, go to Edit -> Find and type FS6519.dll.vbs or TTMS1117.dll.vbs or taga lipa.

Edit the found registry by selecting the name, ryt click and modify, remove the last two strings which is wscript.exe and FS6519.dll.vbs or TTMS1117.dll.vbs or taga lipaand click OK.

If finished, press F3 and it will search again for another, just do the same thing until nothing is found in your registry.

If you are done with the FS6519.dll.vbs or TTMS1117.dll.vbs or taga lipa, its time for the TAGA LIPA ARE! be edited in your IE, type the string on the search again then it will show up the IE title ... modify then type anything you like or better delete

in other words:

Read and follow this instruction carefully.

1. Go to My Computer -> Tools Menu -> Folder Options -> View Tab
2. Check Show hidden files and folders
3. Uncheck Hide extensions for known file type and Hide protected operating system files
4. When Windows displays a popup warning you about protected operating system files, click on Yes
5. Click on OK
6. Search for FS6519.dll.vbs and autorun.inf on your hard disk drive and delete all instances of this file.
7. If you get a warning that something is using the program. Press Ctrl+Alt+Del (to bring up the Task Manager) and go to Processes, end all instances of wscript.exe. Close the Task Manager afterwards.
8. Run regedit.exe
9. Go to Edit -> Find and type FS6519.dll.vbs.
10. Edit any matching registry entry by selecting it, right-click to modify, remove the last two strings which is wscript.exe and FS6519.dll.vbs, and click on OK.
11. To continue searching for other matching entries, press F3. Repeat step 10 if another match is found.
12. To remove the IE title TAGA LIPA ARE!, search that string again in the registry and delete the string for every matching entry.


NOTE: Only two files are responsible for these malware to be function.
Dont use double click when accessing drive(partitions), instead type the
drive letter to ad bar.
1. DELETE the "autorun.inf"
2. DELETE the "FS6519.dll.vbs"

found it from the web

[lightning_mcqueen95]

Bitaw... mao ni ang maka pa AUTOPLAY sa drive C: ug uban pa na drive. hasta ang Mobil disk nimo o Flash drive... Makalagot raba kaayo ni... Usbon niya imo registry gud...

[lightning_mcqueen95]

Dali raba kaayo ni motakod.... basta paslak nimo imo FlashDrive takdan dayon na... ang uban format dayon para dali...

[whoopz]

if dili autoplay ang pag double click sa imo drives, pasabot dili infected imo pc?

pero masakpan raman ni sa kaspersky ug nod32 diba?

[sleepydeepeyed]

good

[thedreamer]

yup sakpan ra sa nod32... :mrgreen:

[EarlZ]

Nod32 gets rid of it, just manually delete the autorun.inf

[Visual C#]

I just got spam with this virus as an attachment. Amusing really, as I was downloading the attachment using a Mac, you can actually view the damn virus's source code by opening it using TextEdit.

[Rainerius]

Idol gyud nako ang mga pinoy. master sa binuang!

[d3dx9]

Usually kining mga malware kay naa ni sa

C:\system32\filename.dll.vbs
C:\filename.dll.vbs

Other partition of harddrives example D:\

D:\filename.dll.vbs