Destrukto Virus Removal

-
To manually remove this virus, do the following:

1. Download a replacement to task manager such as Process Manager by Sysinternals at http://www.networkworld.com/community/?q=node/4241.

2. Open a command prompt window and go to windows\system32 and get ready to rename WSCRIPT.EXE by typing rename WSCRIPT.EXE WSCRIPT.TMP (or delete it).

3. Run Process Manager and kill the WSCRIPT process and then run the rename or delete command on the WSCRIPT.EXE.

4. Once WSCRIPT.EXE is renamed or deleted, you will most likely get a Windows message that system files are changed or deleted. Cancel the dialog box when prompted. The script will no longer be able to pop up the DESTRUKTO Internet Explorer page.

5. Download a registry editor such as mpam4_regedit_xp from http://www.patheticcockroach.com/mpam4/ind...?p=61&id=14.

6. Run the registry editor and reverse the key changes the virus made. Change them back so everything is enabled:

ran.regwrite "HKCU\Software\Microsoft\Internet Explorer\Main\Window Title","DESTRUKTO!!!!!"

ran.regwrite "HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Explorer",wendows&"\system32\explorar.vbs"

ran.regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind",1,"REG_DWORD"

ran.regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun",1,"REG_DWORD"

ran.regwrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools",1,"REG_DWORD"

ran.regwrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr",1,"REG_DWORD"

ran.regwrite "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden",0,"REG_DWORD"

ran.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\NoFolderOptions",1,"REG_DWORD"

ran.regwrite "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableConfig",1,"REG_DWORD"

ran.regwrite "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore\DisableSR",1,"REG_DWORD"

ran.regwrite "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun",0,"REG_DWORD"

7. Reboot after the registry changes and then run MSCONFIG and remove the line referencing a RUN command for EXPLORAR.VBS.

That's it. You should be good to go. Below is a copy of the Windows Script that runs when the machine is infected. You can see how the script works.

I am hoping Spyware and Virus companies will contact Eugene Young or I to create definitions so that there is an automatic removal for non technical users.

Source: Here

Any suggestion, question or violent reaction? Feel free to leave a comment.

View Random Post

Comments

Anonymous said…
Noob.Killer Update
# Added Destrukto (Destrukto.vbs/Explorar.vbs)
# ImgKulot :)

Cheers
Viva Las Filipinas!
-Leerz
January 11, 2008 at 7:43 PM
Online Malware Removal said…
Great application to remove virus on your computer, but remember to consult first experts before using such tool to avoid total breakage of your computer ;)
November 7, 2011 at 9:50 AM
Post a Comment

Popular posts from this blog

How to check if your PSP can have CFW installed

-
Image
Taken from: atmaxplorer.com I’ve been receiving tons of questions on how to check if their PSP can have custom firmware installed. Here’s a complete and concise guide to get you going. Make sure to read through the guide fully since it will answer all your psp motherboard related questions. First of, you need to understand that there are three types of PSPs: 1) 1000 Series (Also known as PSP Phat/Fat) 2) 2000 Series (Also known as PSP Slim or Lite & Slim) 3) 3000 Series (Also known as PSP Brite) So why install Custom Firmware on a PSP? People install Custom Firmware so they can run Homebrew, programs developed by people that don’t have a contract with Sony. A PSP with Custom Firmware could also back up your games from the UMD to your computer; it also allows you to play those backups from your Memory Stick (MS). You could also do some serious customizations to your theme. Basically, you free your PSP from the hands of Sony. Why can’t I install Custom Firmware on my ...
Read more

Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged (code 19)

-
Image
Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged (code 19)- CD ROM Device Manager Error One of my client brought in a Dell Latitude laptop that has a problem with its CD ROM. According to the owner he can't access his CD. The model of his CD Rom is Samsung CD ROM SN-124. Upon inspection, I found out that the device (CD ROM drive) is missing from his My Computer (as you can see on the image below) At first, I thought that the problem lies with the connection of the CDROM because I had it disassembled a week before due to display problem. The CD Rom is snap in type, so I easily took it out and back in without hassle. Upon logging in to windows, the problem still persist. Next, I checked the Device Manager (right-click My Computer, choose Properties, then Hardware and click on Device Manager). As you can see on the picture below, there is a problem with the CD ROM because there is a yellow exclamation mark befor...
Read more

Funny UST Scandal Avi.Exe Remover

-
Funny UST Scandal Virus Removal Tool Automatic remover = Download this: Funny UST Scandal Avi.exe Remover Manual: Software used to build the virus= AutoIt V3 drop Files- killer.exe(4084 kb) in c:\windows\ lsass.exe(3920kb) in c:\documents and settings\all users\start menu\programs\startup smss.exe(4088kb) in all root drives and in c:\windows autorun.inf(1kb) in all root drives with a script [autorun] open=smss.exe shell\Open\Command=smss.exe shell\open\Default=1 shell\Explore\Command=smss.exe shell\Autoplay\command=smss.exe Funny UST Sandal.avi.exe(228kb) in all root drives Registry Entries-HKLM\Software\Microsoft\WindowNT\CurrentVersion\Winlogon=shell(killer.exe) HKCU\Software\Microsoft\windows\Currentversion\Run=runonce(c:\windows\smss.exe) HOw to remove this lame virus???? -first download taskiller in http://www.rsdsoft.com/task_killer/index.php4 and install it to your computer because you cant use taskmanager to terminate the virus(the virus automatically close taskmanager). -run t...
Read more