[RESOLVED] Plz help Virus Removal

[ravininave]

Hi,
My PC is infected with virus. It creaets the same .exe file as the folder name. Means If I've a folder Named c:\Ravi then it automatically creates .exe file in C:\Ravi\ with Folder like icon. If someone thinks if it's a folder and clicks it, it opens a My Doc Folder. It Removes Folder options from XP Tools Menu and Folder Option from Control Panel. It locks Registry. It locks MSConfig command as when I type MSConfig the system get Restart. If I try to enter into a folder where I've kept some .reg file the system get restarted automatically. Even when I open any code into VB which uses any registry stuff, the machine get restarted automatically and the most Important thing is that it Slows down the System. For that I wrote a small VB Code which will unlock Registry. Show the folder Option. Deletes all entries from HKLM/Software/Microsoft/Windows/Current Version/ Run,Run Services,Run ServicesEx. But when I start the registry after running this vb code, Registry get started and suddenely alternately my PC also get Restarted and again it locks the registry and all the things. What to do I tried with all the AntiViruses like Norton,Quick Hill, Avg...

Please Help How it slows down my PC? How it recognize .reg files and how He had written such a code within an .exe which is just 40 mb in size.
Thanks in Advance.

Ravikant.

[si_the_geek]

Moved from FAQ forum

Welcome to VBForums!

Have you tried booting into safe mode, and then running a virus scanner?
Are your virus scanner(s) up to date?
Have you tried anti-spyware tools?

[Atheist]

Perhaps youve already tried using it, but Id like to recommend Antivir, www.avira.com
i use it, and its way better than those expensive antivirus softwares, like Norton.

[litlewiki]

Check if an application named ODIYAN.EXE is visible in your task list .If so ,you will also find a process named rundl1.dll running in your process list.If thats so then you are infected with a nasty yet harmless virus which only copies itself to each and every new folder that is created with the same name and with the icon of a folder.

Removing it is not a big deal,just boot into safe mode and uncheck suspicious entries in the system startup folder,services and the load on start up page(start>run>msconfig>services and startup).Then delete all those nasty exes or just run a virus scan as athesit suggested!

p.s: you will also notice that your cdrom and floppy drives are behaving strangely.

[ravininave]

Actually this virus comes from Mobile Memory Cards. Yes it creates sub-folder in every folder but as u said that it's not harmless. It's not so. This virus slows down the PC. If u're working on even P4 machine with latest configuration it converts it's speed as P1. Other thing is this that it doesn't allow to enter in MSConfir or in RegEdit neither in Normal nor in Safe mode. Even if u open any Folder which contains any .reg files machine get Restarted even in Safe Mode.

[si_the_geek]

Have you tried the suggestions above for removing it?

[The_Duck]

There are some online virus scanners you might want to try

http://www.pandasoftware.com/actives..._principal.htm

http://uk.trendmicro-europe.com/cons...all_launch.php

http://www.bitdefender.com/scan8/ie.html

http://security.symantec.com/sscv6/d...d=ie&venid=sym

http://us.mcafee.com/root/mfs/default.asp

http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

[ravininave]

Thank u all. Thanx for ur great help. The problem get solved by the utility named hijack This. Using that I deleted all the unknown keywords from Registry and now my PC is working well. But can anyone will plz tell me that how does it slows down the machine. Does he has written some code on CPU or RAM so that they go on loop?????

Ravikant.

[si_the_geek]

I expect that it would be something like that, but thankfully it doesnt matter any more.


As you have now solved this, could you please do us a little favour, and mark this thread as Resolved?
(this saves time reading for those of us who like to answer questions, and also helps those who search to find answers)

You can do this by clicking on "Thread tools" just above the first post in this thread, then "Mark thread resolved".