A friend of mine got 2 superb viruses just yesterday, how he managed to catch them in the same day i don’t know :)) , but I got the solution. OK, let’s start:
UPDATE:
How to remove Win32.Saburex.a from your computer:
1. Restart in Safe mode (Hit F8 when Windows starts)
2. Delete the following file:
c:\windows\System32\ole16.dll
3. Open Start -> Run -> regedit.exe (and hit enter)
4. Go to:
[HKEY_CLASSES_ROOT\CLSID\{00021401-0000-0000-C000-
000000000046}\InProcServer32]
5. Replace: (default)=”ole16.dll” with (default)=”shell32.dll”
and
ThreadingModel=”Both” with ThreadingModel=”Apartment”
6. Go to:
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00021401-
0000-0000-C000-000000000046}\InProcServer32]
7. Replace: (default)=”ole16.dll” with (default)=”shell32.dll”
and
ThreadingModel=”Both” with ThreadingModel=”Apartment”
8. Delete all files from all the Temp directories.
9. Run this removal tool.
Ok, and now, how to remove Win32.Warezov.gl:
1. Reboot the computer in Safe Mode (at the start of the boot sequence, press and hold F8, then choose Safe Mode from the Windows boot menu).
2. Use Task Manager to terminate the following process:
cservv32.exe
3. Manually delete the files listed below from the Windows root and system directories:
c:\windows\ñservv32.exe
c:\windows\cservv32.s
c:\windows\cservv32.wax
c:\windows\cservv32.dat
c:\windows\system32\e1.dll
4. Delete the following entries from the system registry:
[HKLM\Software\Microsoft\Windows\CurrentVersion\Run]
“cservv32″ = “c:\windows\cservv32.exe s”
[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows]
“AppInit_DLLs” = “e1.dll”
5. Reboot the computer and check that you have deleted all infected messages from all mail folders.
6. Update your antivirus databases and perform a full scan of the computer
The funny thing is that they are complete different viruses, Warezov it’s a stupid mail virus. I wouldn’t catch it even if I try :)) I how everyone is “clean” :P
PS: trebuie si varianta romaneasca? Ca, eu unul, pricep ce am scris :D
85 reacţii · Comenteaza · Urmăreste comentariile prin RSS