Thread: Need help to remove virus

Hi, My PC has got infected by some virus. It shows the following message when i log into my system.

"Surabaya in my birthday
Don't kill me, i'm just send message from your computer."

Is it a virus or any spyware?
I m not able to delete my folders and all the folders have got .scr extension.
And yes yesterday i have plugged my pen drive to the system.
Can anyone help?

Herez how to remove this malicious program manually... And fix ur windows...

Remove Surabaya in my birthday, happy birthday virus - W32/Drowor.worm

Originally Posted by Robdale

Hi, My PC has got infected by some virus. It shows the following message when i log into my system.

"Surabaya in my birthday
Don't kill me, i'm just send message from your computer."

Is it a virus or any spyware?
I m not able to delete my folders and all the folders have got .scr extension.
And yes yesterday i have plugged my pen drive to the system.
Can anyone help?

Install the trial version of Kaspersky 2009. And scan the PC using it. The spyware should be detected and removed automatically.

BTW which is your current AV software?

Thanks itsmemad, it worked but it has only removed the .scr extension. The folders are still showing the Test, Configure after doing right click on the folder and opening in new window.

Originally Posted by Robdale

Thanks itsmemad, it worked but it has only removed the .scr extension. The folders are still showing the Test, Configure after doing right click on the folder and opening in new window.

Did u go through http://www.indiabroadband.net/comput...tml#post114385 (Need help to remove virus) ?

Yes... i have AVG Antivirus updated version. I have scanned whole system but was unable to remove.

Originally Posted by Robdale

Yes... i have AVG Antivirus updated version. I have scanned whole system but was unable to remove.

AVG is quite weak against an infected PC. U need robust solutions like Kaspersky 2009. I repeat install kaspersky 2009 trial, scan and repair the pc, uninstall it and continue using AVG.

@Robdale
It is a Spyware and you can try out Avg antispyware if you are not using AVG8 or you can try out Spyware Doctor..just Google it, you will get it..and still problem persists you can reinstall XP after taking backup..and let us know the status of your problem..

Yeah.. Try scanning & then repairing with Kaspersky 2009... It should repair atleast new window opening problem...

Thanks everybody, I installed the kaspersky 2009 and it has solved my problem. I appreciate all of your assistance.

Thats great!

Now to avoid infections like this in future... Make 2 dummy folders viz. autorun.inf & rqq2v.bat in each partition(hide them if u want)... This helps in preventing malicious programs infecting ur computer...

U can also make these 2 folders in ur pen drive & external hdd!

P.S.- I won't mind a rep point...

Originally Posted by itsmemad

Thats great!

Now to avoid infections like this in future... Make 2 dummy folders viz. autorun.inf & rqq2v.bat in each partition(hide them if u want)... This helps in preventing malicious programs infecting ur computer...

U can also make these 2 folders in ur pen drive & external hdd!

P.S.- I won't mind a rep point...

Seems like a good idea, but how does it protect the drive from infections? Dont we need to alter the permissions of the created folders so that spyware will be ineffective against altering those folders?

Most of the peoples get virus from their pen drive only, and from the pen drive the virus got a chance to attack coz of autorun.inf file residing in the root folder.

Some antivirus like kaspersky can clean these autorun.inf files along with the virus, but if you are not using kaspersky then you should try "Autorun Eater" which is not an antivirus but effectively deals with these autorun.inf files.

Hey this Autorun Eater seems cool. And its free too!!

Download it from Autorun Eater v2.3 « Old McDonald’s Farm

Originally Posted by cool_techie_tvm

Seems like a good idea, but how does it protect the drive from infections? Dont we need to alter the permissions of the created folders so that spyware will be ineffective against altering those folders?

We need not worry about autorun.inf files after we make those folders in our drives... no need to change permissions of folders... Spywares are not programmed to alter or overwrite folders with those names...

Hmm maybe i should try this on an infected machine. Thanks for the tip itsmemad

You are welcome... Its just a preventive measure... Try it on a clean PC & then try infecting it... autorun.inf won't do the damage!

guys dont you think the best way to prevent autorun.inf worms is to disable autorun completely on your system. do we really need autorun feature?

if a good antivirus is running on the background and autorun is disabled ... as soon as you open/explore the removalbe drive - the worm and the autorun.inf will be cleaned automatically ... this works really fine for me ...

As far as I know autorun.inf viruses can infect ur computer even if u try to open the pen-drive by a double-click... It doesn't matter if the autorun option is disabled or not...

Some antiviruses are able to block them... some not!

Originally Posted by itsmemad

As far as I know autorun.inf viruses can infect ur computer even if u try to open the pen-drive by a double-click... It doesn't matter if the autorun option is disabled or not...

Some antiviruses are able to block them... some not!

that happens because sometimes the default action for double click gets set to "autorun" ... whenever you right click a drive you will see the "open" option in bold characters ... sometimes it gets set to "autorun" by viruses/malwares themselves... i.e. when you diuble click it actually autoruns ... ...

The easiest and most effective means to truly disable autorun :

start menu -> run -> gpedit.msc -> user configurations -> administrative templates -> system -> turn off autoplay ---- set this option to enable ...

try this ... you wont regret

Well... maybe...
BTW, My autorun option is always disabled...

Friends many of your PC/laptop's normally gets virus because of Pen Drives or USB devices (Even PC's who are not connected to network ). Some Virus like Ravmon Virus , Heap41a worm which are not detected by anti virus normally spreads mostly by the Pen Drives . In such a case what can you do to prevent your PC from getting infected with Virus that spreads through USB devices or Pen Drives ?

You can protect your PC by just following the simple steps below . It won't take much time.

Connect your Pen Drive or USB drive to your computer .

Now a dialogue window will popup asking you to choose among the options as shown in the figure



Don't choose any of them , Just simply click Cancel.

* Now go to Start--> Run and type cmd to open the Command Prompt window
* Now go to My Computer and Check the Drive letter of your USB drive or Pen Drive. ( E.g. If it is written Kingston (I , then I: will be the drive letter .)
* In the Command Window ( cmd ) , type the drive letter: and Hit Enter .
* Now type dir/w/o/a/p and Hit Enter
* You will get a list of files . In the list , search if anyone of the following do exist:

1. Autorun.inf
2. New Folder.exe
3. Bha.vbs
4. Iexplore.vbs
5. Info.exe
6. New_Folder.exe
7. Ravmon.exe
8. RVHost.exe or any other files with .exe Extension .

If you find any one of the files above , Run the command attrib -h -r -s -a *.* and Hit Enter.
Now Delete each File using the following Command del filename ( E.g del autorun.inf ) .

That's it . Now just scan your USB drive with the anti virus you have to ensure that you made your Pen Drive free of Virus .

Hi Friends...
This virus is very very common now...
To know whether ur system is infected just type C:\heap41a in the address bar...
if there is a folder named heap41a, then ur system is infected...
(AVAST antivirus is the best solution for this worm...) symantec also works.

Thanks.

Though the process is lengthy... But still thanks for sharing... Might be helpful...

Rep awarded..

Originally Posted by Robdale

Connect your Pen Drive or USB drive to your computer .

May i ask something? Once we connect an infected USB drive to the PC, wont it be infected that instant? Arent most of the trojans/spywares designed to act like that?

also take a look at some these ... ways to remove virus and prevent PDs from them :

How to Disable Autorun

How to keep your pen drive virus free | Doon Valley Blog

3 Ways Protect Your USB Pen Drive From Virus | TECH YARD

Flash Drive Virus Removal - Free PC Clinic , Best Computer Support Site of Sri Lanka

also take a look at some these ... ways to remove virus and prevent PDs from them :

How to Disable Autorun

How to keep your pen drive virus free | Doon Valley Blog

3 Ways Protect Your USB Pen Drive From Virus | TECH YARD

Flash Drive Virus Removal - Free PC Clinic , Best Computer Support Site of Sri Lanka