Virus Experts

Conficker Manual Removal Guide

2009-06-09T21:22:00.000-07:00

Conficker Description

Conficker, also known as W32/Conficker.worm, Win32/Conficker.A, W32.Downadup, Downadup and Kido, is a worm that exploits flaws found in Windows MS08-067 vulnerability. When Conficker infects your PC, it may prevent you from accessing security websites and disables Windows system services such as Windows Security Center, Windows Error Reporting and Windows Defender. The danger with Conficker is its ability to spread itself to other vulnerable computers through network shares. If one computer in a network is infected, then it can spread to other computers within that network. Microsoft has released a patch to fix the Windows vulnerability.

Conficker Manual Removal Instructions

1b. How to Kill Conficker DLL files.

Right-click the Explorer.exe process and choose the option “Properties”.
Click on the “Threads” Tab, locate and highlight the Conficker DLL files listed below.
To kill Conficker DLL files, click the “Kill” button.
Kill the following Conficker DLL files:

%All Users Application Data%\[RANDOM FILE NAME].dll
%Program Files%\Movie Maker\[RANDOM FILE NAME].dll
%Program Files%\Internet Explorer\[RANDOM FILE NAME].dll
%Temp%\[RANDOM FILE NAME].dll
vhoinp.dll
%System%\[RANDOM FILE NAME].dll

Step 1: How to Delete Conficker Registry Keys and Values.

Right-click on your Desktop > select “New” option > select “Text Document” (.txt file) option.
Rename the .txt file as a .reg file and call it “Delete_Registry_Conficker_Entities.reg”. This renamed .reg file is a command that creates a shortcut to your Windows registry and allows you to easily delete registry values.
Right-click and select the “Edit” option.
Copy and paste the Conficker keys listed below.
In the menu bar, go to “File” > select “Save” > then click the “X” button to close the file.
Double-click on the .reg file.
When the message box appears saying “Are you sure you want to add the information in C:DOCUME~1%username%DesktopDELETE~1.REG to the registry?”, click the “Yes” button.
When the message box appears saying “Information in C:DOCUME~1%username%DesktopDELETE~1.REG has been successfully entered into the registry.”, click the “OK” button.
The Conficker registry keys have been deleted from your registry.
Copy and paste the following Conficker keys:Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWSNT\CURRENTVERSION\WINDOWS\APPINIT_DLLS\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\URLSearchHooks\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Explorer Bars\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Extensions\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\vhoinp.dll]
[-HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\vhoinp.dll]
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\vhoinp.dll]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\vhoinp.dll]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN\vhoinp.dll]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\vhoinp.dll]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\vhoinp.dll]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\vhoinp.dll]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\vhoinp.dll]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE\vhoinp.dll]
[-HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCEEX\vhoinp.dll]

Generic Trojan / Adware Infestation Removal Procedures

2009-01-16T07:11:00.000-08:00

Generic Trojan / Adware Removal Procedures
(2 different procedures you can try for malware removal)
By: David Lipman

Procedure #1

Download the following four items (links will open a new browser window)...

McAfee Stinger
http://vil.nai.com/vil/stinger/

Trend Sysclean Package
http://www.trendmicro.com/download/dcs.asp

Latest Trend Virus Pattern Files. (example; lpt285.zip*)
http://www.trendmicro.com/download/pattern.asp
(*The file name lpt285.zip is simply an example name of the file and you'll find the filename posted at TrendMicro will have a higher number than 285. Each time TrendMicro produces new Pattern Files the number in the file name will be incremented accordingly.)

Ad-Aware SE (free personal edition)
http://www.lavasoftusa.com/
Create a new directory.
On drive "C:\"
(e.g., "c:\New Folder")
or the desktop
(e.g., "C:\Documents and Settings\username\Desktop\New Folder")

Place SYSCLEAN.COM (the Trend Sysclean Package referenced above) into the new directory you created. Extract the latest Trend Virus Pattern Files (Example: lpt$vpn.285 and WHATSNEW.TXT) from the zip file you downloaded above into the same new directory you created. The Trend Pattern File contained in the ZIP file must be placed in the same directory as SYSCLEAN.COM!

Important: The TrendMicro Pattern file is updated reguarly. Aywhere from once per day to a few times in a day. Always make sure you have the latest version of SYSCLEAN.COM and the Pattern File before you scan your platform. The McAfee Stinger Internet worm and Trojan removal tool is upgraded periodically. Always make sure you have the latest version of McAfee Stinger utility before you scan your platform.
Install and Update Ad-Aware with the latest definitions.
If you are using WinME or WinXP, disable System Restore.
http://vil.nai.com/vil/SystemHelpDocs/DisableSysRestore.aspx
Reboot your PC into Safe Mode [F8 key during boot process].

How to Boot Into Safe Mode:

Generic
Windows XP
How to perform a clean boot in Windows XP
Using McAfee Stinger, the Trend Sysclean utility and Ad-Aware, perform a Full Scan of your platform and clean and/or delete any infectors and/or parasites found (a few cycles may be needed).
Restart your PC and perform a "final" Full Scan of your platform using McAfee Stinger, the Trend Sysclean utility and Ad-Aware.
If you are using WinME or WinXP,Re-enable System Restore and re-apply any System Restore preferences (e.g. HD space to use suggested 400 ~ 600MB).
Reboot your PC.
If you are using WinME or WinXP, create a new Restore point

End of Procedure #1

* * * Please report back your results * * *

Procedure #2

Download MULTI_AV.EXE from the URL --
http://www.pctipp.ch/index.cfm?pid=1411&pk=28470

It is a self-extracting ZIP file that contains the Kixtart Script Interpreter { http://kixtart.org - Kixtart is CareWare } 4 batch files, 6 Kixtart scripts, one Link (.LNK) file, a PDF instruction file and two utilities; UNZIP.EXE and WGET.EXE. It will simplify the process of using; Sophos, Trend, Kaspersky and McAfee Anti VirusCommand Line Scanners to remove viruses, Trojans and various other malware.

C:\AV-CLS\StartMenu.BAT -- { or Double-click on 'Start Menu' in C:\AV-CLS}
This will bring up the initial menu of choices and should be executed in Normal Mode.
This way all the components can be downloaded from each AV vendor’s web site.
The choices are; Sophos, Trend, McAfee, Kaspersky, Exit this menu and Reboot the PC.

You can choose to go to each menu item and just download the needed files or you can download the files and perform a scan in Normal Mode. Once you have downloaded the files needed for each scanner you want to use, you should reboot the PC into Safe Mode [F8 key during boot] and re-run the menu again and choose which scanner you want to run in Safe Mode. It is suggested to run the scanners in both Safe Mode and Normal Mode.

When the menu is displayed hitting 'H' or 'h' will bring up a more comprehensive PDF help file.

To use this utility, perform the following...
Execute; Multi_AV.exe { Note: You must use the default folder C:\AV-CLS }
Choose; Unzip
Choose; Close

Execute; C:\AV-CLS\StartMenu.BAT
{ or Double-click on 'Start Menu' in C:\AV-CLS }

NOTE: You may have to disable your software FireWall or allow WGET.EXE to go through your FireWall to allow it to download the needed AV vendor related files.

End of Procedure #2

* * * Please report back your results * * *

How to remove virus from mobile phone?

2009-01-16T01:10:00.000-08:00

Shit happens, or any virus has attacked your mobile, its inevitable u do something wrong, Now what to do you simply have to format your phone. To format the phone, press *#7370#, then enter the lock code, which is the sec code of the phone. NOTE: battery must be filled, else if format is disrupted by low battery, consequences will be disastrous.
I heard the code *#7780# works too, pretty much the same i think. For 6600 users, to format the fone, there's an alternative way. Press and hold <3>, <*>, and the buttons, then power on fone, keep holding on the 3 buttons, till u come to a format screen. This method ONLY works on 6600, and need not enter the sec code. BUT sec code wun be reset to default 12345

How to Manually Remove Net Screen Watcher ?

2009-01-03T22:58:00.000-08:00

Net Screen Watcher:

1. a spyware program

2. monitors user activity on the compromised computer

3. can capture screenshots of the compromised computer

4. also modifies Windows registry

5. run each time Windows is started

Solution:

1. Temporarily Turn off System Restore.
2. Update the virus definitions.
3. Reboot computer in SafeMode (During BootUp process Press F8)
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry.

Click Start > Run
Type regedit at the box
Click OK.

Navigate to and delete the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Management\ARPCache\Net Screen Watcher ÍøÂçÆÁÄ»¼àÊÓ¹ÜÀí¶Ë ÆóÒµ°æ V1.78 (2008.08.26) wxw.mynsw.cn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Screen Watcher ÍøÂçÆÁÄ»¼àÊÓ¹ÜÀí¶Ë ÆóÒµ°æ V1.78 (2008.08.26) wxw.mynsw.cn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Screen WatcherÓÃ»§¶Ë£¨ÊÜ¼àÊÓ¶Ë£© ÆóÒµ°æ For Win98 V1.68 Beta3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Screen WatcherÓÃ»§¶Ë£¨ÊÜ¼àÊÓ¶Ë£© ÆóÒµ°æ For Windows Vista V1.68 Beta3
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Screen WatcherÓÃ»§¶Ë£¨ÊÜ¼àÊÓ¶Ë£© ÆóÒµ°æ For Windows2000/XP/2003 V1.68 (2007.08.03) wxw.mynsw.cn
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Net Screen WatcherÓÃ»§¶Ë£¨ÊÜ¼àÊÓ¶Ë£© ÆóÒµ¾«¼ò°æ For Windows2000/XP/2003 V1.68 (2007.11.14) wxw.mynsw.cn
HKEY_LOCAL_MACHINE\SOFTWARE\ZQNSWkey
HKEY_LOCAL_MACHINE\SOFTWARE\ZQkey
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NSWServer
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBSTOR
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”mynsw” = “C:\Program Files\Net Screen Watcher\wntsrv.exe”

6. Exit registry editor and restart the computer.
7. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software.

How To Manually Remove Vundo Trojan ?

2008-12-26T05:38:00.000-08:00

Vundo Description:

Vundo is a widely-spread trojan that shows large amount of unsolicited pop-up advertisements. The spyware also silently downloads from the Internet and runs arbitrary potentially harmful files, mostly adware components. Vundo is distributed by e-mail in messages containing links to insecure web sites, which exploit certain security vulnerabilities of the Internet Explorer web browser. Once the user clicks on such a link, Internet Explorer opens a dangerous site that automatically installs the trojan into the computer without user knowledge and consent. Vundo is responsible for the severe decrease of the amount of computer virtual memory available. This results in noticeable PC performance slowdowns. Vundo secretly runs on every Windows startup.

Vundo Manual Removal Instructions:

Step 1 : Use Windows File Search Tool to Find Vundo Path

Go to Start > Search > All Files or Folders.
In the "All or part of the the file name" section, type in "Vundo" file name(s).
To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
When Windows finishes your search, hover over the "In Folder" of "Vundo", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Vundo in the following manual removal steps.

Step 2 : Use Registry Editor to Remove Vundo Registry Values

To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
To delete "Vundo" value, right-click on it and select the "Delete" option.
Locate and delete "Vundo" registry entries:

HKEY_CURRENT_USERSoftwareMicrosoftInternetExplorerMainActiveState 02F96FB7-8AF6-439B-B7BA-2F952F9E4800
HKEY_LOCAL_MACHINESOFTWAREClassesATLEvents.ATLEvents.1
HKEY_LOCAL_MACHINESOFTWAREClassesATLEvents.ATLEvents 8109AF33-6949-4833-8881-43DCC232B7B2 2316230A-C89C-4BCC-95C2-66659AC7A775
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunOnce*[filename]
HKEY_CURRENT_USER SoftwareMicrosoftInternet ExplorerMainActive State
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunOnce*WinLogon
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{8109AF33-6949-4833-8881-43DCC232B7B2}
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{2316230A-C89C-4BCC-95C2-66659AC7A775}
HKEY_LOCAL_MACHINE SOFTWAREMicrosoftWindows CurrentVersionExplorerBrowser Helper Objects{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE SOFTWAREClassesCLSID{02F96FB7-8AF6-439B-B7BA-2F952F9E4800}
HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents.1
HKEY_LOCAL_MACHINE SOFTWAREClassesATLEvents.ATLEvents
HKEY_CLASSES_ROOTCLSID{8109AF33-6949-4833-8881-43DCC232B7B2}
HKEY_CLASSES_ROOTCLSID{2316230A-C89C-4BCC-95C2-66659AC7A775}
HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows CurrentVersionRunOnce*[filename]
HKEY_CURRENT_USER SoftwareMicrosoftWindows CurrentVersionRunOnce*WinLogon

Step 3 : Use Windows Command Prompt to Unregister Vundo DLL Files

To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
Type "cd" in order to change the current directory, press the "space" button, enter the full path to where you believe the Vundo DLL file is located and press the "Enter" button on your keyboard. If you don't know where Vundo DLL file is located, use the "dir" command to display the directory's contents.
To unregister "Vundo" DLL file, type in the exact directory path + "regsvr32 /u" + [DLL_NAME] (for example, :C\Spyware-folder\> regsvr32 /u Vundo.dll) and press the "Enter" button. A message will pop up that says you successfully unregistered the file.
Search and unregister "Vundo" DLL files: vzbb.dll

Step 4 : Detect and Delete Other Vundo Files

To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
To change directory, type in "cd name_of_the_folder".
Once you have the file you're looking for type in "del name_of_the_file".
To delete a file in folder, type in "del name_of_the_file".
To delete the entire folder, type in "rmdir /S name_of_the_folder".
Select the "Vundo" process and click on the "End Process" button to kill it.
Remove the "Vundo" processes files: vzbb.dll

How To Remove Zlob Trojan?

2008-12-23T06:50:00.000-08:00

What's Zlob Trojan?

Zlob Trojan is a backdoor Trojan which can give an anonymous attacker remote control over your PC. Zlob Trojan also lets the attacker execute commands on your PC, so that the attacker can gain control of your system and disable your security. Zlob Trojan puts your personal and financial information at risk.

Do I have Zlob Trojan?

Slow computer performance
New desktop shortcuts or switched homepage
Annoying popups on your PC

How did I get Zlob Trojan?

Freeware or Shareware
Peer-to-Peer Software
Questionable Websites

Remove Zlob Trojan Manually!

To remove Zlob Trojan manually, you need to delete Zlob Trojan files.

Step 1 : Use Windows File Search Tool to Find Zlob Path

Go to Start > Search > All Files or Folders.
In the "All or part of the the file name" section, type in "Zlob" file name(s).
To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.
When Windows finishes your search, hover over the "In Folder" of "Zlob", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete Zlob in the following manual removal steps.

Step 2 : Use Windows Task Manager to Remove Zlob Processes

To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.
Click on the "Image Name" button to search for "Zlob" process by name.
Select the "Zlob" process and click on the "End Process" button to kill it.
Remove the "Zlob" processes files:

msmsgs.exe
nvctrl.exe
msmsgs.exe
nvctrl.exe

Step 3 : Use Registry Editor to Remove Zlob Registry Values

To open the Registry Editor, go to Start > Run > type regedit and then press the "OK" button.
Locate and delete the entry or entries whose data value (in the rightmost column) is the spyware file(s) detected earlier.
To delete "Zlob" value, right-click on it and select the "Delete" option.
Locate and delete "Zlob" registry entries:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonShell=explorer.exe
HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows NT CurrentVersionWinlogonShell=explorer.exe, msmsgs.exe
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunRegSvr32=%System%msmsgs.exe
HKEY_LOCAL_MACHINE SoftwareMicrosoftWindows CurrentVersionRunRegSvr32=%System%msmsgs.exe

Step 4 : Use Windows Command Prompt to Unregister Zlob DLL Files

To open the Windows Command Prompt, go to Start > Run > type cmd and then click the "OK" button.
Type "cd" in order to change the current directory, press the "space" button, enter the full path to where you believe the Zlob DLL file is located and press the "Enter" button on your keyboard. If you don't know where Zlob DLL file is located, use the "dir" command to display the directory's contents.
To unregister "Zlob" DLL file, type in the exact directory path + "regsvr32 /u" + [DLL_NAME] (for example, :C\Spyware-folder\> regsvr32 /u Zlob.dll) and press the "Enter" button. A message will pop up that says you successfully unregistered the file.
Search and unregister "Zlob" DLL files:

uimcu.dll
antzozc.dll
dtjby.dll

Step 5 : Detect and Delete Other Zlob Files

To open the Windows Command Prompt, go to Start > Run > type cmd and then press the "OK" button.
Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.
To change directory, type in "cd name_of_the_folder".
Once you have the file you're looking for type in "del name_of_the_file".
To delete a file in folder, type in "del name_of_the_file".
To delete the entire folder, type in "rmdir /S name_of_the_folder".
Select the "Zlob" process and click on the "End Process" button to kill it.
Remove the "Zlob" processes files:

uimcu.dll
antzozc.dll
dtjby.dll
dumpserv.com
zxserv0.com
vnp7s.net
Protect
RSA
ncompat.tlb
msvol.tlb
hp[X].tmp
msmsgs.exe
nvctrl.exe
dumpserv.com
zxserv0.com
vnp7s.net
%UserProfile%\Application Data\Microsoft\Protect
%UserProfile%\Application Data\Microsoft\Crypto\RSA
ncompat.tlb
msvol.tlb
hp[X].tmp

Note: Here "%System" is a variable referring to your PC's System folder. Maybe you renamed it, but by default your System folder is "C:\Windows\System32" on Windows XP, "C:\Winnt\System32" on Windows NT/2000," or "C:\Windows\System" on Windows 95/98/Me.

"%Program_Files", "%ProgramFiles", or "%Profile" is a variable referring to a folder in your PC where applications that aren't a part of your PC's operating system are installed by default. You may have changed this folder's name or moved it, but if you didn't touch it, find the folder as "C:\Program Files". If you're having trouble finding this folder, you can locate it by looking up registry value "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ProgramFilesDir".

Also, "%UserProfile" is a variable referring to your current user's profile folder. If you're using Windows NT/2000/XP, by default this is "C:\Documents and Settings\[CURRENT USER]" (e.g., "C:\Documents and Settings\JoeSmith").

How To Manually Remove SCVHOST.EXE Virus?

2008-12-21T05:56:00.000-08:00

In some antivirus they are detected as W32/YahLover.Worm.gen from McAfee Antivirus and Win32/Autorun.R.worm from NOD32

Solution:

Restart your PC and press F8 and select the option Safe Mode Command Prompt Only
And after you log-in the command prompt you must log-in as Administrator.
Type cd C:\windows\system32
Type dir /ah, to display all hidden files on this directory folder. You will see the following files which is used by the virus to spread itself: AUTORUN.INI, BLASTCLNNN.EXE, and SCVHOST.EXE
Type ATTRIB -H -R -S SCVHOST.EXE
Type ATTRIB -H -R -S BLASTCLNNN.EXE
Type ATTRIB -H -R -S AUTORUN.INI
Type DEL SCVHOST.EXE
Type DEL BLASTCLNNNN.EXE
Type DEL AUTORUN.INI
Type CD\
Type ATTRIB -H -R -S AUTORUN.INF
Type DEL AUTORUN.INF

You are almost done, reboot your PC.

Go Start Menu and click the Run and type the REGEDIT command. Take note guys before make any changes into your Registry Editor you must make a full back-up to your registry to avoid system errors. :)

Look the location entry:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, if you see an entry Yahoo! Messengger (it’s spelled like this) with a value c:\windows\system32\scvhost.exe, Delete this entry.

Look the location entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, in the entry named: SHELL, a value = Explorer.exe,SCVHOST.EXE. Edit this value, delete the SCVHOST.EXE only and the value must be Explorer.exe. Once you delete all this value, your computer will not login anymore.

We are now done. Please Restart your PC now.

How to remove WORM_AGENT.VDO?

2008-12-17T08:40:00.000-08:00

Solution:

Identifying the Malware Program

To remove this malware, first identify the malware program.

Scan your computer with your antivirus product.
NOTE the path and file name of all files detected as WORM_AGENT.VDO.

Terminating the Malware Program

This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.

If the process you are looking for is not in the list displayed by Task Manager, proceed to the succeeding solution set.

Open Windows Task Manager.
• On Windows 98 and ME, press
CTRL+ALT+DELETE
• On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

Editing the Registry

This malware modifies the computer's registry. Users affected by this malware may need to modify or delete specific registry keys or entries. For detailed information regarding registry editing, please refer to the following articles from Microsoft:

Removing Autostart Entry from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup. In this procedure, you will need the name(s) of the file(s) detected earlier.

If the registry entry below is not found, the malware may not have executed as of detection. If so, proceed to the succeeding solution set.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries whose data value is the malware path and file name of the file(s) detected earlier.

Restoring Modified Registry Entry

Still in the Registry Editor, in the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft\
Windows NT\CurrentVersion\Winlogon
In the right panel, locate the entry:
Userinit = "%System%\userinit.exe, {Malware name}"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)
Right-click on the value name and choose Modify. Change the value data of this entry to:
Userinit = "%System%\userinit.exe,"
Close Registry Editor.

Deleting AUTORUN.INF

Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
In the Named input box, type:
AUTORUN.INF
In the Look In drop-down list, select a drive, then press Enter.
Select the file, then open using Notepad.
Check if the following lines are present in the file:
[Autorun]
OPEN=fooool.exe
shell\open=
shell\open\Command=fooool.exe
shell\open\Default=1
shell\explore=
shell\explore\Command=fooool.exe
If the lines are present, delete the file.
Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
Close Search Results.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Running Antivirus

If you are currently running in safe mode, please restart your computer normally before performing the following solution.

Scan your computer with antivirus and delete files detected as WORM_AGENT.VDO. To do this, users must download the latest virus pattern file and scan their computer.

How to remove newfolder.exe or regsvr.exe or autorun.inf virus?

2008-12-15T07:04:00.000-08:00

1. Cut The Supply Line

Search for autorun.inf file. It is a read only file so you will have to change it to normal by right clicking the file , selecting the properties and un-check the read only option
Open the file in notepad and delete everything and save the file.
Now change the file status back to read only mode so that the virus could not get access again.
Click start->run and type msconfig and click ok
Go to startup tab look for regsvr and uncheck the option click OK.
Click on Exit without Restart, cause there are still few things we need to do before we can restart the PC.
Now go to control panel -> scheduled tasks, and delete the At1 task listed their.

2. Open The Gates Of Castle

Click on start -> run and type gpedit.msc and click Ok.
If you are Windows XP Home Edition user you might not have gpedit.msc in that case download and install it from Windows XP Home Edition: gpedit.msc and then follow these steps.
Go to users configuration->Administrative templates->system
Find “prevent access to registry editing tools” and change the option to disable.
Once you do this you have registry access back.

3. Launch The Attack At Heart Of Castle

Click on start->run and type regedit and click ok
Go to edit->find and start the search for regsvr.exe,
Delete all the occurrence of regsvr.exe; remember to take a backup before deleting. KEEP IN MIND regsvr32.exe is not to be deleted. Delete regsvr.exe occurrences only.
At one ore two places you will find it after explorer.exe in theses cases only delete the regsvr.exe part and not the whole part. E.g. Shell = “Explorer.exe regsvr.exe” the just delete the regsvr.exe and leave the explorer.exe

4. Seek And Destroy the enemy soldiers, no one should be left behind

Click on start->search->for files and folders.
Their click all files and folders
Type “*.exe” as filename to search for
Click on ‘when was it modified ‘ option and select the specify date option
Type from date as 1/31/2008 and also type To date as 1/31/2008
Now hit search and wait for all the exe’s to show up.
Once search is over select all the exe files and shift+delete the files, caution must be taken so that you don’t delete the legitimate exe file that you have installed on 31st January.
Also selecting lot of files together might make your computer unresponsive so delete them in small bunches.
Also find and delete regsvr.exe, svchost .exe( notice an extra space between the svchost and .exe)

5. Time For Celebrations

Now do a cold reboot (ie press the reboot button instead) and you are done.

Soon all antivirus programs will be able to automatically detect and clean this virus.

Four Easy Steps to Manually Remove Viruses from Your Computer!

2008-12-13T07:05:00.000-08:00

[Note: This solution will work only against those Viruses which does not infect Windows own .exe files (e.g. like Explorer.exe)]

Some of the symptoms of viruses are:

Disables Task Manager
Disables Registry Editor
Disables Command Prompt
Sometime you have no application running but CPU usage goes over 50%
Computer Drives are not opening by Double Click
Automatic Shutdown
Computer Slows down
Hidden Files will not be showing
Folder Options will disappear

Solution:
[Caution: While the manual process is going on do not open any My Computer drive through My Computer]

Step1. Process Termination

Download Process Explorer and Autoruns in order to complete the instructions below.

Close all programs (even from tray) except your Internet Browser.
Run Process Explorer by typing procexp in the Start menu. Run and do as illustrated.

After collapsing:

[Note: procexp.exe is Process Explorer’s own process]

All the system processes are collapsed in the system tree, so if you see a process like winlogon.exe in explorer tree then it is surely a virus.

If you do see any suspicious process, Processes can be sought for their suspiciousness at Process Library. And follow the following steps:

Right click on it if the process is found and then properties. In the path: field copy the path and Open Run Dialogue and paste the path there.
Now terminate the suspicious task in Process Explorer.
If the same process starts again then suspend the process by right clicking on it and click suspend on the menu. Remove the name of the application from path now listing only folder.

E.g.:- If you have copied C:\WINDOWS\System32\mspaint.exe then remove mspaint.exe and you will see C:\WINDOWS\System32\ this in the Run Dialogue.

Step2. File Deletion

The second step is deleting files. If you have installed powerexe, Start Menu–> 7-ZIP–> 7-ZIP File Manager which will show you all hidden files and go through the root path of every drive.

Delete .exe and autorun.inf like ravmon.exe, smss.exe, Funny UST Scandal.exe. But do not delete the following files autoexec.bat, boot.ini, bootmgr, config.sys, io.sys, msdos.sys, ntdetect.com, pagefile.sys, ntldr, hiberfil.sys as these are system files.

Step3. Removal of Startup Entries

Now you have successfully terminated virus process the next thing is to remove those virus files which run upon system start.

Open Autoruns by typing autoruns in the Run Dialogue. Wait while refreshing completes.
In the Options –> Hide Microsoft Entries. And click Refresh button on the interface OR Close the program and start again.
After scanning completes select Logon tab and uncheck all the entries be sure do not unselect any Microsoft Entry. Restart system for the changes to take effect.

Step4. Restoring Windows Default settings

Now scan your system with a fully functional Anti-Virus will be the last suggestion.

Troubleshooting: Incase of any problem means you did a wrong move. Open Autoruns, in the Options –> Unselect Hide Microsoft Entries. And click Refresh button on the interface OR and select all entries. Close the program and start your system again.

How to manually remove Backdoor.livup (msstart.exe) Trojan-horse?

2008-12-07T06:29:00.000-08:00

This method only works on Windows 2000/XP/2003/NT/ME.

Step 1: Configure Microsoft Windows Explorer to show all files, because most Virus and Trojan horse can hide itself. If you already did it, you may skip this step.

1. Click Start, point to Settings, and Control Panel, and then click Folder Options.

2. In the Folder Options dialog box, click the View tab.

3. In the Advanced settings box, deselect the Hide protected operating system files (Recommended).

4. Select the Show hidden files and folders.

5. Deselect the Hide file extensions for unknown file types.

6. Click OK to save changes.

Or Download RRT(Remove Restrictions Tool) a tool to re-enable Ctrl+Alt+Del, Folder Options and Registry tools.

Step 2: Press Ctrl+Alt+Del, open Task Manager Program, click Processes tab, and find msstart.exe process, if found, select it and click End Process to kill it.

Step 3: Go to the folder of SystemRoot\Winnt\System32 (If your Windows NT/2000/XP/2003 installed on driver C: then the folder is C:\Winnt\System32), find msstart.exe and directly delete it. Or you can also search for all of msstart.exe files by using Windows Search feature (WINDOWS+F shortcut key), and delete them all.

If all of the steps are completed correctly, then the Trojan has been completely removed.

How To Manually Remove Trojan?

2008-11-10T06:48:00.000-08:00

If you have identified the particular program that is part of the malware, and you want to remove it, please follow these steps.

Download and extract the Autoruns program by Sysinternals to C:\Autoruns
Reboot into Safe Mode so that the malware is not started when you are doing these steps. Many malware monitor the keys that allow them to start and if they notice they have been removed, will automatically replace that startup key. For this reason booting into safe mode allows us to get past that defense in most cases.
Navigate to the C:\Autoruns folder you created in Step 1 and double-click on autoruns.exe.
When the program starts, click on the Options menu and enable the following options by clicking on them. This will place a checkmark next to each of these options.
1. Include empty locations
2. Verify Code Signatures
3. Hide Signed Microsoft Entries
Then press the F5 key on your keyboard to refresh the startups list using these new settings.
The program shows information about your startup entries in 8 different tabs. For the most part, the filename you are looking for will be found under the Logon or the Services tabs, but you should check all the other tabs to make sure they are not loading elsewhere as well. Click on each tab and look through the list for the filename that you want to remove. The filename will be found under the Image Path column. There may be more than one entry associated with the same file as it is common for malware to create multiple startup entries. It is important to note that many malware programs disguise themselves by using the same filenames as valid Microsoft files. it is therefore important to know exactly which file, and the folder they are in, that you want to remove.
Once you find the entry that is associated with the malware, you want to delete that entry so it will not start again on the next reboot. To do that right click on the entry and select delete. This startup entry will now be removed from the Registry.
Now that we made it so it will not start on boot up, you should delete the file using My Computer or Windows Explorer. If you can not see the file, it may be hidden.
When you are finished removing the malware entries from the Registry and deleting the files, reboot into normal mode as you will now be clean from the infection.

Top 10 computer virus threat and what can you do about it?

2008-11-07T22:31:00.000-08:00

1. Number of password-stealing Web sites will increase using fake sign-in pages for popular online services

WCYD: You can visually verify the URL or even better type the URL on your own rather than clicking on a link received via email.

2. Volume of spam, particularly bandwidth-eating image spam, will rise

WCYD: You can't do much about this other than enabling text only viewing on their mail application. You can hope that your security administrators will install anti SPAM gateway which can filter out image SPAM.

3. Popularity of video sharing on the Web makes it inevitable that hackers will target MPEG files

WCYD: Stick to well known video sharing sites and hope that they do something about this! or even stay away from video sharing sites if practical.

4. Mobile phone attacks will become more prevalent as mobile devices become smarter.

WCYD: Install mobile phone anti-virus software. Make sure that signature is updated. This could be one of the things to ask the mobile company before you buy your next mobile phone.

5. Adware will go mainstream

WCYD: You can't do much about this. You could discourage products from companies that use this slimy advertising channel.

6. Identity theft and data loss will continue to be a public issue

WCYD: Identity theft has been a nuisance for several years. The victims of identity fraud include lawyers, doctors and security professionals. It is a good idea to protect yourself so that you don't become a identity theft victim.

7. The use of bots will increase as a tool favoured by hackers

WCYD: You can't do much about hacker's trend. You can prevent your computer being used as a bot by installing firewall to block unauthorized services. Installing anti-virus, anti-spyware and host intrusion prevention system will provide layered defense.

8. Parasitic malware, or viruses that modify existing files on a disk, will make a comeback

WCYD: You can install anti-virus Et. Al.

9. The number of rootkits on 32-bit platforms will increase

WCYD: Your traditional anti-virus software usually comes with rootkit detection, removal capability. Make sure to check with your anti-virus software vendor about its effectiveness in the removal of rootkits. I heard Symantec Norton ranks best in rootkit removal, but you should consult experts before you make the decision.

10. Vulnerabilities will continue to cause concern fueled by the underground market for vulnerabilities

WCYD: You can't do much about this other than not supporting folks who try to create a market for vulnerabilities.

Trojan.Vundo Removal Tool

2008-10-12T06:33:00.000-07:00

This tool is designed to remove the infections of the following threats:

Important:

If you are on a network or have a full-time connection to the Internet, such as a DSL or cable modem, disconnect the computer from the network and Internet. Disable or password-protect file sharing, or set the shared files to Read Only, before reconnecting the computers to the network or to the Internet. Because this worm spreads by using shared folders on networked computers, to ensure that the worm does not reinfect the computer after it has been removed, Symantec suggests sharing with Read Only access or by using password protection.

For instructions on how to do this, refer to your Windows documentation, or the document: How to configure shared Windows folders for maximum network protection.
If you are removing an infection from a network, first make sure that all the shares are disabled or set to Read Only.
This tool is not designed to run on Novell NetWare servers. To remove this threat from a NetWare server, first make sure that you have the current virus definitions, and then run a full system scan with the Symantec antivirus product.

How to download and run the tool

Important: You must have administrative rights to run this tool on Windows NT 4.0, Windows 2000, or Windows XP.

Note for network administrators: If you are running MS Exchange 2000 Server, we recommend that you exclude the M drive from the scan by running the tool from a command line, with the Exclude switch. For more information, read the Microsoft knowledge base article: XADM: Do Not Back Up or Scan Exchange 2000 Drive M (Article 298924).

Follow these steps to download and run the tool:

Download the FixVundo.exe file from: Download Removal Tool
Save the file to a convenient location, such as your Windows desktop.
Optional: To check the authenticity of the digital signature, refer to the "Digital signature" section later in this writeup.

Note: If you are sure that you are downloading this tool from the Security Response Web site, you can skip this step. If you are not sure, or are a network administrator and need to authenticate the files before deployment, follow the steps in the "Digital signature" section before proceeding with step 4.
Close all the running programs.
If you are on a network or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
If you are running Windows Me or XP, turn off System Restore. For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
Locate the file that you just downloaded.
Double-click the FixVundo.exe file to start the removal tool.
Click Start to begin the process, and then allow the tool to run.

Note: If you have any problems when you run the tool, or it does nor appear to remove the threat, restart the computer in Safe mode and run the tool again.
Restart the computer.
Run the removal tool again to ensure that the system is clean.
If you are running Windows Me/XP, then reenable System Restore.
If you are on a network or if you have a full-time connection to the Internet, reconnect the computer to the network or to the Internet connection.
Run LiveUpdate to make sure that you are using the most current virus definitions.

When the tool has finished running, you will see a message indicating whether the threat has infected the computer. The tool displays results similar to the following:

Total number of the scanned files
Number of deleted files
Number of repaired files
Number of terminated viral processes
Number of fixed registry entries

trojan-downloader.win32.agent (ZLOB) Virus removal

2008-10-11T00:52:00.000-07:00

How To Remove Virus Without Using Antivirus Program ?

2008-10-09T01:44:00.000-07:00

Information security in economic slowdown!

2008-09-12T05:21:00.000-07:00

There is no doubt that this economy is impacting all companies and most individuals. I've read about and heard from many organizations that, as a result, their information security and privacy budgets are being drastically reduced, or even cut completely, in an attempt to save money during these uncertain times.

Throwing out the baby with the bath water in this way is a very bad idea!

As the economy continues to be bad, you are going to see more cybercrime attempts, and more cybercrime successes. All the more reason for folks to stay security aware and practice good security.

Yes, now is the time to make smart information security investments. There are many ways in which organizations can have good security without overpaying. So it *IS* a good time to review your information security expenditures.

One of the ways is to invest in the comparatively inexpensive information security and privacy training and awareness activities. Humans have always been
the weakest link in information security success. Take the time, without the large bucks, to make personnel your best security tool.

And, of course, maintain your basic security tools, such as firewall updates, up-to-date anti-malware protections, and enforced policies, just to name a few.

If your company is struggling, the last thing you want to happen is a security incident that could have been prevented; a security incident and/or privacy breach could just be the final nail in the coffin for your organization.

Free Virus Removal Tools

2008-09-10T22:04:00.000-07:00

By BITDEFENDER

Backdoor.IRC.Sticy.A (.exe)	download
Backdoor.K0wbot.1.2 / 1.3.A / 1.3.B (.exe)	download
BackDoor.Rebbew (A,B,C,D) (.exe)	download
Backdoor.Sticy.B (.exe)	download
I-Worm.Sircam (.exe)	download
Trojan.VB.AE (.exe)	download
Win32.Antiman.A@mm (.exe)	download
Win32.Auric.A@mm (.exe)	download
Win32.Badtrans.B@mm (.exe)	download
Win32.Bagle.A@mm (.exe)	download
Win32.Bagle.AU@mm (.exe)	download
Win32.Bagle.{C-E}@mm (.exe)	download
Win32.Bagle.FO@mm (.exe)	download
Win32.Bagz.B@mm (.exe)	download
Win32.Bride.A@mm (.exe)	download
Win32.Bride.B@mm (.exe)	download
Win32.Bride.C@mm (.exe)	download
Win32.Brontok.A@mm (.exe)	download
Win32.BugBear.A@mm (.exe)	download
Win32.BugBear.B@mm (.exe)	download
Win32.BugBear.C@mm (.exe)	download
Win32.Dumaru.A@mm (.exe)	download
Win32.Dumaru.B/C@mm (.exe)	download
Win32.Dumaru.Y@mm (.exe)	download
Win32.Elkern.A (.exe)	download
Win32.Evaman.A@mm (.exe)	download
Win32.Fizzer.A@mm (.exe)	download
Win32.Frethem.F@mm (.exe)	download
Win32.Funlove (.exe)	download
Win32.Ganda.A@mm (.exe)	download
Win32.Gibe.A@mm (.exe)	download
Win32.Gone.A@mm (.exe)	download
Win32.Holar.H@mm (.exe)	download
Win32.IISWorm.CodeRed.F (.zip)	download
Win32.Ivrol.A@mm (.exe)	download
Win32.Jeefo.A (.exe)	download
Win32.Klez.A@mm (.exe)	download
Win32.Klez.D@mm (.exe)	download
Win32.Klez.E@mm (.exe)	download
Win32.Klez.H@mm (.exe)	download
Win32.Lirva.B@mm (.exe)	download
Win32.LovGate.C@mm
antilovgate-en.exe	download
antilovgate-en.exe	download
Win32.LovGate.G/H/J/K@mm (.exe)	download
Win32.Mabutu.A@mm (.exe)	download
Win32.Magistr.B@mm (.exe)	download
Win32.Melare.A@mm (.exe)	download
Win32.Mimail.A@mm (.exe)	download
Win32.Mimail.C@mm (.exe)	download
Win32.Mimail.D,E,F,H@mm (.exe)	download
Win32.Mimail.I@mm (.exe)	download
Win32.Msblast.A (.exe)	download
Win32.Msblast.B (.exe)	download
Win32.Msblast.C (.exe)	download
Win32.Msblast.F (.exe)	download
Win32.Muce.A (.exe)	download
Win32.Mydoom.B@mm (Win32.Novarg.B@mm) (.exe)	download
Win32.Myparty.A@mm (.exe)	download
Win32.Neroma.A@mm (.exe)	download
Win32.Neroma.B@mm (.exe)	download
Win32.Netsky.B@mm (.exe)	download
Win32.Netsky.Q@mm (.exe)	download
Win32.Nimda.A@mm (.exe)	download
Win32.Nimda.E@mm (.exe)	download
Win32.Novarg.A@mm (.exe)	download
Win32.Nyxem.E@mm (.exe)	download
Win32.Parite.A/B/C (.exe)	download
Win32.Polip.A (.exe)	download
Win32.Sober.AD@mm (.exe)	download
Win32.Sober.A@mm (.exe)	download
Win32.Sober.B@mm (.exe)	download
Win32.Sober.C@mm (.exe)	download
Win32.Sober.D@mm (.exe)	download
Win32.Sober.F@mm (.exe)	download
Win32.Sober.O@mm (.exe)	download
Win32.Sobig.A@mm (.exe)	download
Win32.Sobig.B@mm (Palyh) (.exe)	download
Win32.Sobig.C@mm (.exe)	download
Win32.SoBig.E@mm
antisobig-en.exe	download
antisobig-en.exe	download
Win32.Sobig.F@mm (.exe)	download
Win32.Valhalla.2048 (.exe)	download
Win32.Worm.Benjamin (.exe)	download
Win32.Worm.Bobax.A/C
antibobax-en.exe	download
antitest-en.exe	download
Win32.Worm.Dabber.A (.exe)	download
Win32.Worm.Delf.NCZ (.exe)	download
Win32.Worm.Downadup.Gen
anti-Downadup-EN.zip	download
anti-Downadup-EN.zip	download
anti-downadup.zip	download
Win32.Worm.Korgo.A,B (.exe)	download
Win32.Worm.Korgo.C (.exe)	download
Win32.Worm.Korgo.P (.exe)	download
Win32.Worm.Korgo.R (.exe)	download
Win32.Worm.Mexer.E (.exe)	download
Win32.Worm.Mytob.BY (.exe)	download
Win32.Worm.Opaserv (.exe)	download
Win32.Worm.SQLExp.Slammer.A (.zip)	download
Win32.Worm.Welchia.A (.exe)	download
Win32.Worm.Welchia.B (.exe)	download
Win32.Yahaa.D@mm (.exe)	download
Win32.Yahaa.E@mm (.exe)	download
Win32.Yahaa.J@mm (.exe)	download
Win32.Yahaa.K@mm (.exe)	download
Win32.Yahaa.P@mm/Q@mm (.exe)	download
Win32.Zafi.A@mm (.exe)	download
Win32.Zafi.B@mm (.exe)	download
Win32.Zafi.D@mm (.exe)	download
Worm.Kibuv.A (.exe)	download

Virus Removal Tools

2008-09-09T01:10:00.000-07:00

by Kaspersky Lab

When a new virus appears, timely intervention can prevent damage to your computer and data, and help to prevent the spread of the virus.

Remove a virus for free

Kaspersky Lab has developed free virus removal tools. If your computer has been infected by any of the viruses listed below, you can download a free removal utility here.

Ordered by Name

How To Remove VIRUS From Pendrive?

2008-08-09T01:50:00.000-07:00