Shortcut Virus[Part 1]

Today I will share about how to delete shortcut virus

and for this is the tutorial:



Click for Virus Shortcut[Part 1] :
1. Disable 'System Restore' for a while during the cleaning process.

2. Disconnect the computer that you want to clean from internet

3. Turn of the process of virus use ‘Ice Sword’ tools, after you’ve installed it on your computer, choose a file with icon ‘Microsoft Visual Basic Project' click 'Terminate Process'. You can download ‘Ice Sword’ tool at http://icesword.en.softonic.com/

4. Delete the registry is created by the virus by:
-. Click the [Start]
-. Click [Run]
-. Type Regedit.exe, and click the [OK]
-. On application the Registry Editor, browse the key [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Run]
-. Then delete the key that has the data [C: \ Documents and Settings \% user%].

5. Disable autoplay/autorun Windows. Copy the script under here paste in notepad and then save with name REPAIR.INF choose for ‘All Programs’ after that install that file with Right Click on the REPAIR.INF file ==> And click instal

[Version]
Signature=”$Chicago$”
Provider=Vaksincom
[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del
[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”"”%1″” %*”
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255

6. Delete main files and duplicate files are created by the virus included in the flash disk. To make easier the search process, you can use the 'Search' feature. Before you search the file, you should show all hidden files by changing the Folder Options settings.

Don't get a mistake when deleting a main files and duplicate files that have been created by the virus. Then delete the main files that have characteristics:

-. Icon 'Microsoft Visual Basic Project'.
-. File Size 128 KB (for other variants will have varying sizes).
-. Extension. file '. EXE' or '. SCR'.
-. File type 'Application' or 'Screen Saver'.

Then delete the files duplicate shortcut that have characteristics:

>. 'Folder' icon or the 'icon' icon
>. Extension. LNK
>. File Type 'Shortcut'
>. 1 KB file size

Delete the file. DLL (example: ert.dll) and the Autorun.inf file on flash disk or a shared folder. Meanwhile, to avoid the virus is active again, delete the master file that has the extension EXE or SCR first and then remove Shortcut file (. LNK).

7. Unhide the folders have been hidden by the virus. To speed up the process, please download the tools Unhide Files and Folders in http://www.flashshare.com/bfu/download.html.

Once installed, select the directory [C: \ Documents and Settings] and folders that exist on the flash disk by sliding into a column that is already available. In the [Attributes] empty of all the options, then click the [Change Attributes].

8. Install security patches 'Microsoft Windows Shell shortcut handling remote code execution vulnerability, MS10-046'. Please download the security patch at http://www.microsoft.com/technet/security/Bulletin/MS10-046.mspx

As always, for optimal cleaning and prevent re-infection, you should install and scan with antivirus software that up-to-date and was able to detect this virus very well.
I hope this tutor is useful for us
~Thank you~

Original: BinusHacker

5 comments:

  1. Any issue related with operating system direct contact with Operating System Support

    ReplyDelete
  2. It has managed to always stay forward of most opponents, having an in-depth assortment of slots games. One of the more thrilling features of this offering is that there are some slots games would possibly be} exclusive to 888Casino. Payment Options – Finally, you need to have the ability to shortly and simply conduct deposits and withdrawals. This signifies that you may be} seeking a on line casino website that has an excellent range of transaction strategies. Some of the most 먹튀 검증 사이트 well-liked include debit playing cards, credit cards, and e-wallets. You also need to see what the withdrawal speeds are on a given platform, nicely as|in addition to} assess the transaction limits and any fees would possibly be} in place.

    ReplyDelete