How to get rid of this pesky virus?

[burdagol]

---

Symptoms sa virus:
You are unable to open TaskManager, Regedit, CMD, Msconfig, etc.
Some windows open for fractions of seconds and suddenly gets closed. Like anti-virus,TaskManager, Regedit, cmd etc.
Cannot show hidden files. Coz everytime i try to edit the settings it gets closed.
Creates an .exe on some folder and names itself after the folder where it is contained.
e.g.
My Pictures(inside this folder you'll see a my pictures.exe)

Sa ako pag tanaw sa internet ang name daw sa virus kay ssvichosst. Naa nko mga gi pang suwayan na tools para ayo daw pero wala man ni gana. Ang anti virus sad wala gamit kay e off sa virus. Pag open nmo taod2x e close dayon. Unsaon mani guyz?

Mao ni ang name sa virus na makitan sa mscofig sa start-up

F1695Met(msconfig entry)
nya ang target kay:
C:\windows\system32\s5289\zh591065684y.exe

and
N4938c(msconfig entry)
target directory:
C:\windows\j6310622.exe

Dli nko ma delete kay dli ko ka show hidden files dili sad ma disable sa start-up kay mo close dayon ang msconfig kun hilabtan.

[IT]

ayay ... dako na problema.. padong na fdisk.. format.. re-install system. b4 you do that back-up ka muna.

[cold_fusion]

STEPS ON HOW TO REMOVE THE VIRUS:

Start/run
taskkill /f /t /im “New Folder.exe”
taskkill /f /t /im “SCVVHSOT.exe”
taskkill /f /t /im “SCVHSOT.exe”
taskkill /f /t /im “scvshosts.exe”
taskkill /f /t /im “hinhem.scr”
taskkill /f /t /im “blastclnnn.exe”

Enable Task Manager
Start/run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f
Start/run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f

*Enable Regedit
Start/run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
Start> run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

*Folder Option & Hidden Files
Start/run
reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f

Start/run
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\Explorer /v NoFolderOptions /t REG_DWORD /d 0 /f

Start/run
reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced /v Hidden /t REG_DWORD /d 1 /f

Start/run
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 1 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced\Folder\Hidden\SHOWALL /v DefaultValue /t REG_DWORD /d 2 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced\Folder\Hidden\NOHIDDEN /v CheckedValue /t REG_DWORD /d 2 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Exp lorer\Advanced\Folder\Hidden\NOHIDDEN /v DefaultValue /t REG_DWORD /d 2 /f

*Delete the files
C:\WINDOWS\SCVVHSOT.exe
C:\WINDOWS\SCVHSOT.exe
C:\WINDOWS\hinhem.scr
C:\WINDOWS\system32\SCVHSOT.exe
C:\WINDOWS\system32\blastclnnn.exe
C:\WINDOWS\system32\autorun.ini
C:\Documents and Settings\All Users\Documents\SCVHSOT.exe

*Modify some registries
Start/run/regedit
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ Shell REG_SZ –> explorer.exe
\Software\Microsoft\Windows\CurrentVersion\Run\ Yahoo Messengger –>delete

*Precautions
Never double click on such files which look like folders, instead use folder view for navigation.
You may like to disable “Shared Documents”.

[hunt99]

if dili na madala reformat gyud ka pero pangita sad paagi na maka back up.

[jayher]

cold_fusion thanks bro. it wil help me....

[rexdudev75]

great info! keep it up sir!