This virus affects your system by :
- Disabling Task Manager
- Disabling Registry Editor
- Creates a startup entry to start upon system start and
- Creates its own exe files in Shared Documents folder which appear like ordinary folders.
- Disables Folder Options
- Uses your 50% or more processor
You can see that the folders in Shared Documents have an exe extension If you have unchecked Hide extensions for known file types in Folder Options.
Virus Removal Tool Description 2.5 (Also Removes Nhatquanglan Variant of NewFolder.exe)
Sets these entries in Registry
[sourcecode language='cpp'][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]“NofolderOptions”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]“@”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]“YahooMessengger”=[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogon]“Shell”=”Explorer.exe”[/sourcecode]
[sourcecode language='cpp'][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]“NofolderOptions”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]“@”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]“YahooMessengger”=[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogon]“Shell”=”Explorer.exe”[/sourcecode]
Deletes Virus Files
- svichossst.exe
- autorun.inf
- at1.job
- autorun.ini
- (Nhatquanglan) scvhosts.exe
- blastclnnn.exe
- hinhem.scr
- All duplicated exe files in Shared Documents Folder
- Also the exe files in your selected folder
1:Download
2:Not understand above that?
Step-1:-
Download Winpatrol and instal and run it.It shows all prosses of Windows
Step-2:-
Click the Active tasks and select the NEWFLODER.EXE
Step-3:-
Finally click the KILL TASK button
Download the winpetrol from this link
:::---::: Click to Download :::---:::
No comments:
Post a Comment