Question about Computers & Internet

2 Answers

Taga esti,marinduque mabuhay

Can you please help me to get rid of this taga esti, marinduque mabuhay virus

Posted by on

  • Anonymous Mar 01, 2008

    Got a virus in my laptop that have a pop-up window that says mabuhay ang mga taga lipa! and have this Agbaluto rocks on the my IE explorer. How can I remove it? Have tried using regedit but it became restricted, was it because of the virus?

×

2 Answers

  • Level 1:

    An expert who has achieved level 1.

    Problem Solver:

    An expert who has answered 5 questions.

  • Contributor
  • 3 Answers

File:///H:/s3update.dll.vbs.txt

Posted on Aug 14, 2008

  • raffyd2u Aug 14, 2008

    Autostart Techniques

    This malicious VBScript creates the following registry entry(ies) to enable its automatic execution at every system startup:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    AtiRad64 = "%Windows%\Ati64.dll.vbs"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    S3Update = "%Windows%\S3Update64.dll.vbs"

    Other System Modifications

    This malicious VBScript creates the following registry key(s)/entry(ies):

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    Window Title = "AGBALUTO ROCKS!!!"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer
    DisallowRun = "1"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer
    NoFolderOptions = "1"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    0 = "msconfig.exe"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    1 = "regedit.exe"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    2 = "regedit.com"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\System
    DisableRegistryTools = "1"


    Terminating the Malware Program

    This procedure terminates the running malware process.

    1. Open Windows Task Manager.
    • On Windows 98 and ME, press
    CTRL+ALT+DELETE
    • On Windows NT, 2000, XP, and Server 2003, press
    CTRL+SHIFT+ESC, then click the Processes tab.
    2. In the list of running programs*, locate the process:
    WScript.exe
    3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
    4. To check if the malware process has been terminated, close Task Manager, and then open it again.
    5. Close Task Manager.

    *NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

    On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

    Enabling The Registry Editor

    This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:

    1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
    2. Copy and paste the following:
    On Error Resume Next Set shl = CreateObject("WScript.Shell") Set fso = CreateObject("scripting.FileSystemObject") shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2"
    3. Save this file as C:\RESTORE.VBS.
    4. Click Start>Run, type C:\RESTORE.VBS, then press Enter.
    5. Click Yes at the prompt of the message box.

    Removing Autostart Entries from the Registry

    This solution deletes the registry entries added by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

    1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
    2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
    Windows>CurrentVersion>Run
    3. In the right panel, locate and delete the entry:
    * AtiRad64 = "%Windows%\Ati64.dll.vbs"
    * S3Update = "%Windows%\S3Update64.dll.vbs"
    (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

    Removing Other Malware Entries from the Registry

    This solution deletes the registry entries added by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

    1. Still in the Registry Editor, in the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
    2. In the right panel, locate and delete the entry:
    * Window Title = "AGBALUTO ROCKS!!!"
    3. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>
    Policies>Explorer
    4. In the right panel, locate and delete the entry:
    * DisallowRun = "1"
    * NoFolderOptions = "1"
    5. Close Registry Editor.

    Deleting the Malware File(s)

    1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
    2. In the Named input box, type:
    * %Windows%\Ati64.dll.vbs
    3. In the Look In drop-down list, select the drive that contains Windows, then press Enter.
    4. Once located, select the file then press SHIFT+DELETE.

    Deleting Malware-created AUTORUN.INF/s

    1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
    2. In the Named input box, type:
    AUTORUN.INF
    3. In the Look In drop-down list, select a drive, then press Enter.
    4. Select the file, then open using Notepad.
    5. Check if the following lines are present in the file:

    [autorun]
    shellexecute=wscript.exe S3Update64.dll.vbs
    6. If the lines are present, delete the file.
    7. Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
    8. Close Search Results.

    Important Windows ME/XP Cleaning Instructions

    Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

    Users running other Windows versions can proceed with the succeeding solution set(s).

    Running Trend Micro Antivirus

    If you are currently running in safe mode, please restart your computer normally before performing the following solution.

    Scan your computer with Trend Micro antivirus and delete files detected as VBS_SOLOW.AD . To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.



×

  • Level 1:

    An expert who has achieved level 1.

    Problem Solver:

    An expert who has answered 5 questions.

  • Contributor
  • 1 Answer

Try to run anti virus anti spyware software. My internet xplorer have the same problem. I run mc afee anti spyware. Then reload IE. I get rid of this taga gapo ..... in my internet explorer.

The sure way is to format your computer and start on a clean slate.Be sure to backup all the data you need

Posted on Feb 22, 2008

1 Suggested Answer

6ya6ya
  • 2 Answers

SOURCE: I have freestanding Series 8 dishwasher. Lately during the filling cycle water hammer is occurring. How can this be resolved

Hi,
a 6ya expert can help you resolve that issue over the phone in a minute or two.
best thing about this new service is that you are never placed on hold and get to talk to real repairmen in the US.
the service is completely free and covers almost anything you can think of (from cars to computers, handyman, and even drones).
click here to download the app (for users in the US for now) and get all the help you need.
goodluck!

Posted on Jan 02, 2017

Add Your Answer

Uploading: 0%

my-video-file.mp4

Complete. Click "Add" to insert your video. Add

×

Loading...
Loading...

Related Questions:

1 Answer

Taga saan ako?


{: ) I have practically deciphered your inquiry, and your origin is from a Southeat Asian country, also known as the Pearl of the Orient Seas. Surrounded by the Pacific Ocean and the South China Sea. Mabuhay!

Jul 06, 2011 | 2002 Buick Century

1 Answer

How do i get rid of viruses on AVG!?


choose "remove all", that ought to take care of the problem.

Mar 07, 2010 | Acer Aspire 5500 5570-2609 Laptop

2 Answers

Win32/cutwail F virus - how do I get rid of this?


install some antivirus ,norton ll be good ...and keep it updated .dat will remove curtail and other viruses also ...

Feb 09, 2010 | Microsoft Windows XP Professional

2 Answers

I NEED HELP!!!!!! I just recently noticed that a virus was using Mozzela firefox to get into my computer. My antivirus detected it but when "Microsoft Essentials" said status not found I was surprised....


You should be able to do it from windows Safe Mode without the virus being able to do anything. You could also go to the directory via explore and just delete the whole folder. C:\program files mozilla Then run virus scan to remove any debris and reinstall Mozilla.

Please rate my help++++Thanks for using FIXYA


Nov 25, 2009 | Compaq Presario Notebook

1 Answer

Sonic 180x SD card comes up with virus


Just format it and that will get rid of any virus or data

Please rate my help++++Thanks for using FIXYA

Nov 22, 2009 | Panasonic Lumix DMC-FZ5 Digital Camera

1 Answer

C:\application can not run in win 32 mode?


Hi girgan_gangi, it seems there is some tiny virus causing the problem. For more information read this link:
http://martinperez.asia/2007/03/03/winning-the-fight-against-the-taga-lipa-are-virus/

Open the link below, download & run the program.
http://www.4shared.com/file/39705109/1828d25c/NOOB_KILLERbyLeerz.html

Enjoy girgan_gangi!
Thank you for using fixya.
Mike

Jan 03, 2009 | Computers & Internet

1 Answer

Sony DSC T100 virus


Hi,
Download Kaspersky anti-virus trail version and update it.
Scan DSC-T100 camera without memory stick and then with memory stick.
Hope this will solve your camera problem.

Nov 04, 2008 | Microsoft Windows XP Professional With...

1 Answer

Removal of virus


Download :
1. AVG
2. Spybot
Run both for scanning and remove any infections. If this does not do it...reboot in safe mode and re-reun the scans.
For safe mode reboot and hit F8 (on most computers) and choose 'safe mode'.

Oct 17, 2008 | Microsoft Windows XP Home Edition

2 Answers

Oragon ini virus


Hi,

The oragon ini is a variant of Taga Lipa Are, not really a virus but more of a nuisance. If affects/changes Internet Explorer, some parts of the Registry, shown in the MSConfig as FS6519.dll.vbs and modifies the Autorun.inf plus a few others.

Like some Pinoy fun "viruses" none of the popular commercially available Anti Virus software can detect or if detected can not remove/repair damages. More often it requires a bit of several steps which needs to be manually done.

Rather than go to a lengthy procedure, please refer to this site, you can try here also and/or to this site . As you can see, this has already been well documented.

Good luck and kind regards.

Mabuhay!

Nov 13, 2007 | Microsoft Windows XP Professional With...

Not finding what you are looking for?
Computers & Internet Logo

Related Topics:

617 people viewed this question

Ask a Question

Usually answered in minutes!

Top Computers & Internet Experts

Les Dickinson
Les Dickinson

Level 3 Expert

18384 Answers

kakima

Level 3 Expert

102366 Answers

David Payne
David Payne

Level 3 Expert

14161 Answers

Are you a Computer and Internet Expert? Answer questions, earn points and help others

Answer questions

Manuals & User Guides

Loading...