windows media player . exe ( Virus or Worm).......

[Redman]

---

hi mga istoryans....



has anyone encountered this virus or worm......

na encounter mn gud nako...

its charcteristics

an icon appears on the desktop with Windows Media Player.EXE...when clicked it opens the Windows Explorrer and Some mp3 files shows up with the title sarah geronimo.++title of the song.mp3.exe and other opm songs with mp3 extensions and windows media player icon...when clicked it still opens an explorer window more on autorun worms chartcteristcs and aslo disables ur registry , like when you open your registry...it opens but in seconds closes..

already updated my av... ive been using symantec but wla ....

just wana ask on kinsa nka try tang2 ani

gawas sa Format and Reinstall Windows ha.....heheh....bsin naay tool out there para ani....

hint nako local virus ra ni because of the ttle of the songs generated....hehehehh..........



Help....mga istoryans........


lamats

[alexandra_isabel]

try ug nod32 bro...

[Redman]

dont get me wrong ha.......ill ask u another quiestion....na try na nimo ning nod32 sa ani nga scenario?

[Redman]

no offense to nod32 ha.....tried this and loved it.................symantec lng gmit ani ako nsugatan

[handsoff241]

hi mga istoryans....



has anyone encountered this virus or worm......

na encounter mn gud nako...

its charcteristics

an icon appears on the desktop with Windows Media Player.EXE...when clicked it opens the Windows Explorrer and Some mp3 files shows up with the title sarah geronimo.++title of the song.mp3.exe and other opm songs with mp3 extensions and windows media player icon...when clicked it still opens an explorer window more on autorun worms chartcteristcs and aslo disables ur registry , like when you open your registry...it opens but in seconds closes..

already updated my av... ive been using symantec but wla ....

just wana ask on kinsa nka try tang2 ani

gawas sa Format and Reinstall Windows ha.....heheh....bsin naay tool out there para ani....

hint nako local virus ra ni because of the ttle of the songs generated....hehehehh..........



Help....mga istoryans........


lamats

gisuwayan diay nimog regedit?
pwede nio suwayan nod32, kasagaran mo suggest ana taga cebu jud, labi na si sir apostoles ~~.
pero e try pud mga online nga scans like kaspersky norton avg.. etc. and after you resolve this without reformatting try to secure uniblue registry booster products nya paresan nimo ug deepfreeze para bisan madaut imo registry mabalik ra japon.

ako gamit kay avira free + uniblue + deepfreeze, daghan kay ko gipangdownload nga kanta ug software nga hugaw kaau.. ako na lay molimpyu ma save ang file nga limpyu nya walay daut akong registry.. tanan pc jud safe.

[Redman]

deepfreeze is not an option sa amo bro kay office mn ni bro......bsta complicated..hehehehehh...
a
bout sa registry broo...already stated " like when you open your registry...it opens but in seconds closes.."

oki ill try nod32..karon............

ill try this out......

lamats

anyone out there? another suggestion...........

[autorun]

try kno gamit og threatfire bro or avast .......

[Redman]

already tried nod32 but...unfortunatley wla matang2....next...................

[pridi]

i used processexplorer NT nga utility bro, mura na cya ug task manager. pero ang task manager man gud kay pwede ma disable sa virus. i found nga naay nag dagan nga mswindloader.exe sa memory.... akong gi end task... and after ana kay akong gi search sa registry nga mo load ato den akong gi delete ang entry... so after ato, na OK2x na ang akong PC....

[coco_psy-co]

i think same lang ni sa katong isa ka-post..

try this..

1. Go to Start > Run and type: cmd and press press Ok.
2. You may need to change the directory to root of C:, type: cd \, then press Enter
3. Type: attrib -s -h -r -a autorun.inf, , then press Enter
4. Type: dir, , then press Enter. This will display if Autorun file is present.
5. Type: del autorun.inf, , then press Enter
6. Search for and remove auto.vbs, sowar.vbs, SysRes.vbs, Cool USEP Scandal.vbs
7. You may need to change the directory to root of C:, type: cd \, then press Enter
8. Type: attrib auto.vbs.* -s -h -r -a, then press Enter
9. Type: dir /s auto.vbs, then press Enter
10. If the file is present, type: del auto.vbs, then press Enter
11. Repeat the above commands for each drive on your computer including your flash/usb drive.
12. Repeat these instructions to search for and delete sowar.vbs, SysRes.vbs, Cool USEP Scandal.vbs on each drive if present.
13. Exit the command prompt by typing “exit” and reboot your computer.

finalize it with noobkiller..