Abouy Pc Virus...

[Faheem khan]

Salam and eid mubarak to all...

Dosto mere system mei ek problem hai. And i think ye problem usb ya mobile lagane ki waja se hua hai. Main 4 bar window Xp 2005 Install kar chuka hu. but no progress. Desktop pe jo icon hen unke name change hogaye hen.
My documents ka "Ahsan's documents" My computer ka "Ahsan's computer" while Recycle bin ka Name change hoker " G.W.bush ban chuka hai. second folder option mei hidden file ko show karta hu tho wo directory khud ba khud ghayeb hojati hai. third Commond prompt open karta hu tho wo kuch second bad ghayeb hojata hia....
Please tell me what should I do???

[Niqash]

Download This Utility And scan yr system
http://softwaresection.*************/...t-scandal.html

=====Manually Bhi aap esy Remove Kar Sakty hain===
HOw to remove this virus????

first download taskiller in here and install it to your computer because you can’t use task manager to terminate the virus(the virus automatically close task manager).

run taskiller and left click it on the system tray(the one with a skull icon)
click processes to close the virus, select process and click yes to the question

(process to close)


killer.exe
lsass.exe
smss.exe
note: close only file that have the same icon of Funny UST Scandal.avi.exe

CMD STEPS


1 now, click “start” then “run”
2 type “cmd” without quotes
3 type “cd\” without quotes
4 type “attrib -h -s smss.exe” without quotes
5 type “attrib -h -s autorun.inf” without quotes
6 type “start c:” without quotes (a new window will open)
7 select smss.exe, autorun.inf, Funny UST Scandal.avi.exe and delete it

If theres any drive or a partition type “d:” in command prompt without quotes “d” is the drive letter then repeat the CMD STEPS number 4-7 above…….

- now type this on the command prompt “cd windows” without quotes.
- type “attrib -h -s smss.exe” (without quotes)
- type “start c:\windows” (without quotes)
- delete the file smss.exe
- now, goto c:\documents and settings\all users\startmenu\programs\startup
- delete lsass.exe

click “start” then “run”
type “regedit” without quotes then delete the registry entries above….

[ItHero]

wah niqash bhai aap ki jitni bhi tareef ki jay kam hai

[khaksaar]

bilkul u r right

[reasonableman]

Another way to remove Ahsan Virus

Detailed steps to remove Ahsan's virus :

1. start windows in safe mode with command prompt(user:admin, preferably a user other than having attacked)

2. use RRT Tool to enable run " if disabled".

3. Enable regediting if disabled with following reg key.


REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
4. Open regedit, search and delete all entries with name "Ahsan" , site 110mb.com and Bush.
5. If your folder option is disabled enable it with following reg key "
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre nt Version\Policies\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr ent Version\Policies\Explorer

Check if a DWORD value named NoFolderOptions exists in the pane on the right hand side of the screen
Delete it

6. If you are still unable to view the hidden files, which is disabled by virus, enable it with following proc and key.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Explorer\Advanced. Find the value "Hidden" . Rightclick it and modify it to 1. If Key value hidden is not present create it

7. Check the following registery values and set the values given below in each registery key.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\NOHIDDE N]
"CheckedValue"=dword:02
"ValueName"="Hidden"
"DefaultValue"=dword: 02

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword: 01
"ValueName"="Hidden"
"DefaultValue"=dword:02
8. Now enable "show all hidden files / Hidden system files and folders", and search for following files and delete them all.

system.exe
csrss.exe
Home video.avi.exe
autorun