Question about Operating Systems

2 Answers

Taga esti,marinduque mabuhay

Can you please help me to get rid of this taga esti, marinduque mabuhay virus

Posted by on

  • Anonymous Mar 01, 2008

    Got a virus in my laptop that have a pop-up window that says mabuhay ang mga taga lipa! and have this Agbaluto rocks on the my IE explorer. How can I remove it? Have tried using regedit but it became restricted, was it because of the virus?

×

2 Answers

  • Level 1:

    An expert who has achieved level 1.

    Problem Solver:

    An expert who has answered 5 questions.

  • Contributor
  • 3 Answers

File:///H:/s3update.dll.vbs.txt

Posted on Aug 14, 2008

  • raffyd2u Aug 14, 2008

    Autostart Techniques

    This malicious VBScript creates the following registry entry(ies) to enable its automatic execution at every system startup:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    AtiRad64 = "%Windows%\Ati64.dll.vbs"

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
    Windows\CurrentVersion\Run
    S3Update = "%Windows%\S3Update64.dll.vbs"

    Other System Modifications

    This malicious VBScript creates the following registry key(s)/entry(ies):

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
    Window Title = "AGBALUTO ROCKS!!!"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer
    DisallowRun = "1"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer
    NoFolderOptions = "1"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    0 = "msconfig.exe"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    1 = "regedit.exe"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\Explorer\DisallowRun
    2 = "regedit.com"

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
    Policies\System
    DisableRegistryTools = "1"


    Terminating the Malware Program

    This procedure terminates the running malware process.

    1. Open Windows Task Manager.
    • On Windows 98 and ME, press
    CTRL+ALT+DELETE
    • On Windows NT, 2000, XP, and Server 2003, press
    CTRL+SHIFT+ESC, then click the Processes tab.
    2. In the list of running programs*, locate the process:
    WScript.exe
    3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
    4. To check if the malware process has been terminated, close Task Manager, and then open it again.
    5. Close Task Manager.

    *NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.

    On computers running all Windows platforms, if the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure, noting additional instructions. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

    Enabling The Registry Editor

    This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:

    1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
    2. Copy and paste the following:
    On Error Resume Next Set shl = CreateObject("WScript.Shell") Set fso = CreateObject("scripting.FileSystemObject") shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1" shl.RegDelete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2"
    3. Save this file as C:\RESTORE.VBS.
    4. Click Start>Run, type C:\RESTORE.VBS, then press Enter.
    5. Click Yes at the prompt of the message box.

    Removing Autostart Entries from the Registry

    This solution deletes the registry entries added by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

    1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
    2. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
    Windows>CurrentVersion>Run
    3. In the right panel, locate and delete the entry:
    * AtiRad64 = "%Windows%\Ati64.dll.vbs"
    * S3Update = "%Windows%\S3Update64.dll.vbs"
    (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

    Removing Other Malware Entries from the Registry

    This solution deletes the registry entries added by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

    1. Still in the Registry Editor, in the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Internet Explorer>Main
    2. In the right panel, locate and delete the entry:
    * Window Title = "AGBALUTO ROCKS!!!"
    3. In the left panel, double-click the following:
    HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>
    Policies>Explorer
    4. In the right panel, locate and delete the entry:
    * DisallowRun = "1"
    * NoFolderOptions = "1"
    5. Close Registry Editor.

    Deleting the Malware File(s)

    1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
    2. In the Named input box, type:
    * %Windows%\Ati64.dll.vbs
    3. In the Look In drop-down list, select the drive that contains Windows, then press Enter.
    4. Once located, select the file then press SHIFT+DELETE.

    Deleting Malware-created AUTORUN.INF/s

    1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
    2. In the Named input box, type:
    AUTORUN.INF
    3. In the Look In drop-down list, select a drive, then press Enter.
    4. Select the file, then open using Notepad.
    5. Check if the following lines are present in the file:

    [autorun]
    shellexecute=wscript.exe S3Update64.dll.vbs
    6. If the lines are present, delete the file.
    7. Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drives.
    8. Close Search Results.

    Important Windows ME/XP Cleaning Instructions

    Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

    Users running other Windows versions can proceed with the succeeding solution set(s).

    Running Trend Micro Antivirus

    If you are currently running in safe mode, please restart your computer normally before performing the following solution.

    Scan your computer with Trend Micro antivirus and delete files detected as VBS_SOLOW.AD . To do this, Trend Micro customers must download the latest virus pattern file and scan their computer. Other Internet users can use HouseCall, the Trend Micro online virus scanner.



×

  • Level 1:

    An expert who has achieved level 1.

    Problem Solver:

    An expert who has answered 5 questions.

  • Contributor
  • 1 Answer

Try to run anti virus anti spyware software. My internet xplorer have the same problem. I run mc afee anti spyware. Then reload IE. I get rid of this taga gapo ..... in my internet explorer.

The sure way is to format your computer and start on a clean slate.Be sure to backup all the data you need

Posted on Feb 22, 2008

Add Your Answer

Uploading: 0%

my-video-file.mp4

Complete. Click "Add" to insert your video. Add

×

Loading...
Loading...

Related Questions:

2 Answers

Win32/cutwail F virus - how do I get rid of this?


install some antivirus ,norton ll be good ...and keep it updated .dat will remove curtail and other viruses also ...

Feb 09, 2010 | Microsoft Windows XP Professional

1 Answer

Lord rahul cool virus in my computer.i used trojen remover but it couldn't be removed .so help me


Try to download the free version of AVGFree. This is a free anti-virus program that should help you rid your computer of this virus. You can search for the product on google or you can download the current version directly from this link:

http://download.cnet.com/AVG-Anti-Virus-Free-Edition/3000-2239_4-10320142.html?part=dl-10044820&subj=dl&tag=button&cdlPid=11014801

This is the latest version as of Jan 2010.

NOTE: Please rate our help to keep this free service online.

Jan 09, 2010 | Operating Systems

1 Answer

Runtime error 216 at 0016d758


Hello and thank you for using Fixya!

This issue can occur if your computer is infected with a SubSeven Trojan virus (per, Microsoft).

Run a virus scan and rid of all viruses, malware, etc.

If you have a free antivirus, remove it and install a free trial of Kaspersky. This will rid the virus. You can then uninstall Kasperky and install the free one after removal of trojan.

http://www.kaspersky.com/trials

Hope this helps!

Jennifer

Dec 21, 2009 | Microsoft Windows Vista Ultimate Edition

1 Answer

Sony DSC T100 virus


Hi,
Download Kaspersky anti-virus trail version and update it.
Scan DSC-T100 camera without memory stick and then with memory stick.
Hope this will solve your camera problem.

Nov 04, 2008 | Microsoft Windows XP Professional With...

1 Answer

Removal of virus


Download :
1. AVG
2. Spybot
Run both for scanning and remove any infections. If this does not do it...reboot in safe mode and re-reun the scans.
For safe mode reboot and hit F8 (on most computers) and choose 'safe mode'.

Oct 17, 2008 | Microsoft Windows XP Home Edition

2 Answers

Spyware applications found in my computer


Hi,

I can help you fix it.Would you like a remote access to ur PC.

Waiting for ur reply

Apr 25, 2008 | Microsoft Windows XP Home Edition

4 Answers

MY PC IS INFECTED BY TROJAN HORSE VIRUS


I you have a anti-virus software installed run the scan utility to identify and get rid of it, otherwise go to the link below and download a free edition from AVG Grisift (Download both anti-virus and anti-sypware). Install it , update it (its free), and scan your system to remove the trojan.

Link: www.free.grisoft.com

Jan 09, 2008 | Operating Systems

2 Answers

Oragon ini virus


Hi,

The oragon ini is a variant of Taga Lipa Are, not really a virus but more of a nuisance. If affects/changes Internet Explorer, some parts of the Registry, shown in the MSConfig as FS6519.dll.vbs and modifies the Autorun.inf plus a few others.

Like some Pinoy fun "viruses" none of the popular commercially available Anti Virus software can detect or if detected can not remove/repair damages. More often it requires a bit of several steps which needs to be manually done.

Rather than go to a lengthy procedure, please refer to this site, you can try here also and/or to this site . As you can see, this has already been well documented.

Good luck and kind regards.

Mabuhay!

Nov 13, 2007 | Microsoft Windows XP Professional With...

Not finding what you are looking for?
Operating Systems Logo

Related Topics:

617 people viewed this question

Ask a Question

Usually answered in minutes!

Top Operating Systems Experts

Les Dickinson
Les Dickinson

Level 3 Expert

18298 Answers

Brian Sullivan
Brian Sullivan

Level 3 Expert

27725 Answers

Prashant  Sharma
Prashant Sharma

Level 3 Expert

1127 Answers

Are you an Operating System Expert? Answer questions, earn points and help others

Answer questions

Manuals & User Guides

Loading...