Beware of Vietnamese Viruses on Your Messenger

First of all, i would like to apologize about some unknown message that was sent from my messenger to all of yours messenger. Those message was sent by some kind of Trojan which is breaching my PC and it's look like a Philippine or Vietnamese viruses. Because its language similar with Tagalog.

Trang Web nay coi cung hay, vao coi thu di http://........

this worm name is worm W32.Imaut.N ini.

These Viruses is quite dangerous, so beware of them. They could attack ypur Yahoo Messenger and your others messenger actually, because i have found it on my Network PC too. My Client PC which was infected by the viruses, always send those message to other PC on the network. And the result, i can't open regedit (registry editor) and also taskmgr (task manager) on infected PCs. So i think these viruses is quite dangerous.

On this post, i would like to share some information about fighting these viruses, here they are:

* Enable the regedit to clear the registry entry of the virus by typing on command prompt:

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools

* Enable the task manager by opening the registry (which has been recovered by the first step) and aim to the:

HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Policies\System
you will find entry named "DisableTaskMg" and Clear out that entry to enable your task manager

* Furthermore find the others registry entry which is make your PC send a message automatically, those entries are:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\Winlogon\"Shell" = "Explorer.exe " SVCSHOST.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Run\"Yahoo Messengger" = "%System%\SVCSHOST.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Explorer\WorkgroupCrawler\Shares\"shared" = "[SHARED DRIVE]\ scvhosts.exe"

* Also clear all of the entry which is contained scvhosts.exe ; New Folder.exe and Explorer.exe (with letter E capital).

* And Then, we should terminate the process which was triggered by these viruses by opening the task manager and end the suspected processes which user is yours (not the System). Usually these processes named svchosts.exe , scvhosts.exe ,etc.

* The last one, go to the system folder, such as C:\Windows. Finds executable file who's name same with the previous processes such as: svchosts.exe and clean it immediately

* Scan your computer (Recommended) and Restart your PC to complete the step.

OK, i think that's all folks for the tips in fighting this Vietnam-viruses and thanks for all the source

Posted in: Vietnam-Virus