Funny UST Scandal.avi.exe Virus

AutoIt v3 Script 3,2,8,1 / SMSS.exe / LSASS.exe / KILLER.exe / Funny UST Scandal.avi.exe
============================================================

VIRUS FILES
———–
Name :Funny UST Scandal.avi.exe
Name :SMSS.exe

Icon :Video file (GOM Player)
Type of File :Application
Size :224KB/240KB
Modified :November 20, 2007
Attibutes :Hidden, System (varies)
File Version :3.2.8.1
Description :
Copyright :
CompiledScript :AutoIt v3 Script : 3, 2, 8, 1

BEHIND THE SCREEN
—————–
ModifyRegValue REGISTRYUSERS-1-5-21-436374069-1390067357-839522115-1003SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2{4c4da22a-f800-11db-8de6-806d6172696f}BaseClass
CreateDir C:log
CreateFile C:WINDOWSautorun.inf
CreateFile C:WINDOWSsmss.exe
CreateFile C:WINDOWSkiller.exe
CreateFile C:WINDOWSFunny UST Scandal.exe
CreateFile C:Documents and SettingsAll UsersStart MenuProgramsStartuplsass.exe
ModifyRegValue REGISTRYUSERS-1-5-21-436374069-1390067357-839522115-1003_CLASSES.vbs
CreateRegValue REGISTRYUSERS-1-5-21-436374069-1390067357-839522115-1003_CLASSES.reg
CreateRegValue REGISTRYUSERS-1-5-21-436374069-1390067357-839522115-1003SoftwareMicrosoftWindowsCurrentVersionRunRunonce
ModifyRegValue REGISTRYMACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell
ModifyRegValue REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALLCheckedValue
CreateFile X:autorun.inf
CreateFile X:smss.exe
CreateFile X:Funny UST Scandal.avi.exe

**X=all the drives

IDENTIFIED BY ANTIVIRUS (KAV)
———————–
“Worm.P2P.generic”
“Trojan.generic”

*during installation of virus, not during scanning, i dont have latest update

SOLUTION
——–
1. Enable Regedit, CMD, TaskManager.

2. Restart the comp in “Safe Mode with Command Prompt”

3. Type:
reg delete HKCUSOFTWAREMicrosoftWindowsCurrentVersionRun /v Runonce
reg add HKLMSoftwareMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL /v CheckedValue /t REG_DWORD /d 1
reg add “HKLMSOFTWAREMicrosoftWindows NTCurrentVersionWinlogon” /v Shell /t REG_SZ /d Explorer.exe

4. Type:
del “%windir%autorun.inf” /f /a
del “%windir%smss.exe” /f /a
del “%windir%killer.exe” /f /a
del “%windir%Funny UST Scandal.exe” /f /a
del “C:log” /f /a
del “C:Documents and SettingsAll UsersStart MenuProgramsStartuplsass.exe” /f /a

del “D:autorun.inf” /f /a
del “D:smss.exe” /f /a
del “D:Funny UST Scandal.avi.exe” /f /a

*like this for all drives…

5. Type:
TASKMGR
If not working type:
reg delete **********

6. Type:
EXPLORER
If not working type:
reg delete **********

DOWNLOAD

————-

download these file.

run the file 1.bat in normal mode. (simply run)

run the file 2.bat in safe mode with command prompt.

DETAILS: given in 1.bat, when u run it.

thanks to my friend Murtuza Zhabuawala for creating such an easy to use batch file.

http://piyushlabs.googlepages.com/1.bat

http://piyushlabs.googlepages.com/2.bat