Sunday, May 18, 2008

Remove Subhya Virus

By using latest antivurus u can get security from the “Surabhaiya Virus” But……………..

After cleaning the virus, u may still got the msg every time u login (after restart). Here is the way to remove the msg: 1. Delete the autoexec.bat from '\Documents and Settings\user' if any. 2. Run Regedit, find 'surabaya' and delete the two entries related to the msg. That's all.

Note:
If case u found out that all your folder has file size 40K (which is not suppose to be), it is a virus. It hides your original folder and create one dummy folder (virus). If you have any removeable device like thumb drive or usb hdd, it will create autorun.inf and two more files like thums*.* . So when u insert the infested thumb drive or usb hdd to another pc, it will auto infest that pc unless that pc got very good antivirus to block it.Even the antivirus manages to kill the virus, you may have problem open your thumb drive or usb hdd (windows will prompt u what program to use to view the file).
It is because there is this autorun.inf. To gain access back to your usb device, @ windows explorer, type in your drive letter @ the address bar like F: Once you gain access to the drive, change the folder option to show all files include hidden file. The file most likely will be marked as Hidden, System and Read Only. In case after the folder option setting, u still can't find the file, go to Command Prompt (CMD).
Type in your usb device drive letter (example F and press Enter. Type in the following command: attrib autorun.inf -s -h -r press Enter DEL autorun.inf Now you should be able to view the file. Erase that file then removes and reattachs that usb device and now you can view your usb device. Also unhide and delete this file thumb*.* from your C: or your Thumbdrive or USB HDD root directory. attrib thumb*.* -s -h -r press Enter DEL thumb*.* To unhide all hidden folders: ATTRIB -s -h -r /D /S press Enter.



.

No comments: