Love Virus Removal

‘Love’ Virus from Computers. Virus ‘Folder Love ‘have been known to circulate in Indonesia. See some steps that can be done to counteract this evil program

These steps are steps that can be done to eliminate the virus ‘Folder Love’ manually. As presented by Adi Saputra, antivirus analysts from Vaksincom:

1. Disconnect / disconnect the computer that will be cleared from the network.

2. Disable / turn off ‘System Restore’ process for cleaning the virus.

3. Use the ‘Task Manager’ to kill the virus is active.
Most likely the name ‘csrsc.exe’). To open task manager can be done together with the pressing CTR + Alt + Del, or right-click on the Windows taskbar. Then turn off the virus the click [End Process] the process csrsc.exe.

Delete the files the main Autorun.QBP virus, which is located on the C: \ WINDOWS \ system32, the name csrsc.exe the size of 793 kb and Autorun.inf sized 1 kb. Use search / find, to search for file duplicates another virus, especially in the media sharing or USB Flash / removable drive, the file size of 793 kb of viruses, & with extension exe application and file type khq in the drive. Do not forget to display the attribute ‘Show hidden files …’ attribute and the ‘Hide protected operating …’ in the Folder Options.

5. Delete the registry string is created by the virus. To facilitate the registry can use the script below.

[Version]
Signature = “$ Chicago $”
Provider = Vaksincom Oyee
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKLM, SOFTWARE \ Classes \ batfile \ shell \ open \ command,,, “” “% 1″% * ”
HKLM, SOFTWARE \ Classes \ comfile \ shell \ open \ command,,, “” “% 1″% * ”
HKLM, SOFTWARE \ Classes \ exefile \ shell \ open \ command,,, “” “% 1″% * ”
HKLM, SOFTWARE \ Classes \ scrfile \ shell \ open \ command,,, “” “% 1″% * ”
HKLM, SOFTWARE \ Classes \ piffile \ shell \ open \ command,,, “” “% 1″% * ”
HKLM, SOFTWARE \ Classes \ regfile \ shell \ open \ command,,, “regedit.exe”% 1 ”
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0,
Explorer.exe
[del]
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ policies \ Explorer \ Run

Use the notepad, then save with the name ‘repair.inf’. Use the Save As Type option to be All Files so that the error does not occur. Repair.inf run with the right click, then select [install].

6. For optimal cleaning of the virus Autorun.QBP, use Norman Malware Cleaner is able to detect and eradicate this virus with both