nigelmcloughlin.com

How To Clean Doraemon Virus

There is a new virus from Indonesia spreading from the Internet and is known to act as animation film characters such as Doraemon, Sinchan and Tom & Jerry. This virus will stay in your computer with a Real Media Player icon.

Here are some tips on how to clean it:

1. Better to clean it in safe mode.

2. Turn off the active virus process in memory. Use any task manager substitution tools, ie Itty Bitty process manager (download it at http://majorgeeks.com/Itty_Bitty_Process_Manager_d4690.html)

Do Kill process on some active virus files:
* C:\WINDOWS\Help\explorer.exe
* C:\WINDOWS\system32\300403.exe
* C:\WINDOWS\system32\aparaparsaparyangparipircapar.exe
* C:\WINDOWS\system32\HacKid’s.exe

3. Delete string registry that the virus made. To make it easier, you can use this script registry below.
[Version]
Signature=”$Chicago$”
Provider=Vaksincom Oyee

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, SOFTWARE\Classes\batfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Classes\comfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Classes\exefile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Classes\piffile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Classes\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, SOFTWARE\Classes\scrfile\shell\open\command,,,”"”%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\ControlSet003\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, Hidden,0×00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0×00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden,

UncheckedValue,0×00010001,1
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL, DefaultValue,0×00010001,0

[del]
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, noboe
HKCU, Control Panel\Desktop, SCRNSAVE.EXE
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFolderOptions
HKLM, SOFTWARE\Classes\.reg\shell
HKLM, SOFTWARE\Classes\.txt\shell
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MSCONFIG.EXE
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, NoDispScrSavPage
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableSR
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableConfig

- Use notepad, then save it with the name “repair.inf”

- Run repair.inf with right click, then choose install.

- It is better to make repair.inf file in a clean computer, so the virus won’t active again.

4. Delete virus files that has these characters:
- “Real Player” icon
- .exe extension
- Size: 129kb

Note:

- It’s better if you show hidden files to help you find virus files.
- To make an easier search process, use “Search Windows” with *.exe filter and size 45kb.
- Delete all the virus files which have the same modified date.

5. For an optimal cleansing and to prevent reinfection, use an updated antivirus that can detect and destroy this virus.