Jamesgo.dll Automatic Removal Tool
Computer Repair Blog - A little information about the virus:
W32/Autorun.jamesgo is a worm that can spreads via removable media storage (e.g. flash drive, thumb drive, external hard drive, flash memory, mp3 player) and execute itself via autorun.inf file.
Common Symptoms:
1. Automatically opens MS Word
2. Displays Open(jamesgo.dll) when checking Drive C: properties
For Automatic Removal: Download this - (special thanks to Nokie)
After using the jamesgo.dll automatic remover, i suggest you still follow the manual removal instruction just to make sure that any traces left by the virus will be gone too.
Manual Removal:
1. Show Hidden Files (if you can't show your hidden files because the virus disable this feature, you can use Restriction Removal Tool or RRT to enable it)
- Open Windows Explorer
- On Menu, go to Tools > Folder Options
- Click View tab
- Select “Show hidden files and folders”
2. Restart Computer in SafeMode
- Restart your computer
- Just before Windows start press F8
- Select “SafeMode”
3. Open registry editor, Press F3, type jamesgo in the search box, if found delete (name column). Look further by pressing F3, then delete if found.
After deleting jamesgo, FIND test.vbs, then do the same by deleting every found test.vbs specially WScript\test.vbs
FIND test.reg then Delete,
FIND test.bat again delete
FIND autorun.inf, delete
FIND autorun.ico, delete
4. Search and delete malicious files from your computer
- Go to Start > Search
- Select “All files and Folders”
- Search for the following files and delete if found:
(located on c:\Windows\System32\)
autorun.inf
test.reg
test.bat
test.vbs
(located on c:\)
autorun.inf
test.reg
test.bat
test.vbs
(located on usb drive)
autorun.inf
test.reg
test.bat
test.vbs
4. Download and Run HJT
- Download HiJackThis from TrendMicro
- Run HiJackThis
- Mark all strings with autorun.inf, test.reg, test.bat and test.vbs entries
- Click Fix Checked to fix the entries
- Reboot your computer
Comments