1. Show Hidden Files and Folders not working.
2. My Computer Drives open another explorer window.
3. When you run a program, just in 2 or 3 minutes the program dissappears (Actually runs in background but you can not see its window in foreground).

Removal of this Virus

Unfortunately, I have no removal tool to remove this virus at the time of writing, but you will soon see one. You can try the manual removal of it.

Manual Removal

Caution : While the manual process is going on, do not open any My Computer drive.

1. Open up cmd by typing cmd in Start –> Run.

2. Type in cmd

[sourcecode language='html']taskkill /f /im smss.exe

taskkill /f /im killer.exe[/sourcecode]

3. The virus placed some files at the root of every drive so you need to clean them.

Repeat the following commands on cmd for all your drives (Here it is applied for C drive)

[sourcecode language='html']del /a:h /f c:\autorun.inf

del /a:h /f c:\smss.exe

del /a:h /f c:\funny ust scandal.avi.exe[/sourcecode]

4. Now you need to delete files in windows folder so type :

[sourcecode language='html']del /a:h /f c:\windows\killer.exe

del /a:h /f c:\windows\autorun.inf

del /a:h /f c:\windows\smss.exe

del /a:h /f c:\windows\funny ust scandal.exe[/sourcecode]

5. Now you need to delete one more file :

[sourcecode language='html']del /a:h /f “%userprofile%\StartMenu\Programs\Startup\lsass.exe”[/sourcecode]

6. Use PowerExes to delete startup entries like.

smss.exe

lsass.exe(if it does not remove then only uncheck it)

killer.exe

7. To restore Folder Option Settings Follow this page

Show Hidden Files And Folders Not Working

8. To Remove the virus from Flash Drive, Insert a flash drive cancel any Autoplay box.

Open cmd and type (Replace x by your usb drive letter)

[sourcecode language='html']del /a:h /f x:\autorun.inf

del /a:h /f x:\smss.exe

del /a:h /f x:\funny ust scandal.avi.exe[/sourcecode]

To make a blank autorun.inf, open notepad and Save As “autorun.inf”. Place the autorun.inf in the affected drive.

Having the same problem? Did this trick solve your problem or you had a better solution? Share your experiences.

UPDATE : Please use the following DOS command for the ease of deleting the autorun.inf file.

[sourcecode language='html']C:>attrib -S -H -R C:autorun.inf
C:>del /F C:autorun.inf[/sourcecode]
Replace C with your drive that you want to disable autorun of.

Update: Download Ravmon Removal Tool for an automated
solution to this problem.

To correct all these options, use Ravmon Virus Removal Tool

• Restore Windows Default Settings
• Check Restore All Folder Options
• OK.

Download Ravmon Virus Removal Tool

This virus affects your system by :

• Disabling Task Manager
• Disabling Registry Editor
• Creates a startup entry to start upon system start and
• Creates its own exe files in Shared Documents folder which appear like ordinary folders.
• Disables Folder Options
• Uses your 50% or more processor

You can see that the folders in Shared Documents have an exe extension If you have unchecked Hide extensions for known file types in Folder Options.

Virus Removal Tool Description 2.5 (Also Removes Nhatquanglan Variant of NewFolder.exe)

Sets these entries in Registry
[sourcecode language='cpp'][HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer]“NofolderOptions”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem]“@”=[HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun]“YahooMessengger”=[HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsNTCurrentVersionWinlogon]“Shell”=”Explorer.exe”[/sourcecode]

Deletes Virus Files

• svichossst.exe
• autorun.inf
• at1.job
• autorun.ini
• (Nhatquanglan) scvhosts.exe
• blastclnnn.exe
• hinhem.scr
• All duplicated exe files in Shared Documents Folder
• Also the exe files in your selected folder

Download

http://www.od3n.net/tools/