Overcoming Virus Windows Media Player

As dikabarkan some time ago about the virus that can make computer 'sigh'. To remove this virus on the flash disk can begin to identify and remove files with the extension *. mov, *. wmv, *. 3gp, *. avi, *. mpg, *. mpeg.

Meanwhile, to clean the virus or the golden ghost W32/Agent.GYMR on how hard you can do the following:

To speed up the process of removal of the virus using tools "Ice Sword" (http://www.4shared.com/file/62289467/cf8da562/Ice_Swor d_v122.html? DirPwdVerified = feea1d94). Block the process that has Windows Media Player icon and then right click on the process and click "terminate Process."

Repair registry with a script to copy under this program in Notepad and save it with the name:

"repair.vbs" and run the file.
Dim oWSH: Set oWSH = CreateObject ( "WScript.Shell")
on error resume Next

* WSH.Regwrite "HKEY_LOCAL_MACHINESoftwareCLASSESbatfileshellopen command ","""% 1" "% *"
* WSH.Regwrite "HKEY_LOCAL_MACHINESoftwareCLASSEScomfileshellopen command ","""% 1" "% *"
* WSH.Regwrite "HKEY_LOCAL_MACHINESoftwareCLASSESexefileshellopen command ","""% 1" "% *"
* WSH.Regwrite "HKEY_LOCAL_MACHINESoftwareCLASSESpiffileshellopen command ","""% 1" "% *"
* WSH.Regwrite "HKEY_LOCAL_MACHINESoftwareCLASSESscrfileshellopen command ","""% 1" "/ S"
* WSH.Regwrite "HKEY_LOCAL_MACHINESYSTEMControlSet001ControlSafeB ootAlternateShell", "cmd.exe"
* WSH. Regwrite "HKEY_LOCAL_MACHINESYSTEMControlSet002ControlSafeB ootAlternateShell", "cmd.exe"
* WSH. Regwrite "HKEY_LOCAL_MACHINESYSTEMControlSet003ControlSafeB ootAlternateShell", "cmd.exe"
* WSH. Regwrite "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlS afeBootAlternateShell", "cmd.exe"
* WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonShell", "Explorer.exe & quot;
* WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionWinlogonsystem", ""
*

WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionRegisteredOrganization", "Your Organization" WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionRegisteredOwner", "YourOwner & q uot;
* WSH.Regwrite "HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page", "about: Blank"
* WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionExplorerAdvancedFolderHiddentype", "Gro up"
* WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionExplorerAdvancedFolderHideFileExttype", & quo t; checkbox "
* WSH.Regwrite "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrent VersionExplorerAdvancedFolderSuperHiddentype", & quo t; checkbox "
* WSH.RegDelete ( "HKEY_LOCAL _MACHINESoftwareMicrosoftWindowsCurrentVersionRunGolden Ghost")
* WSH.RegDelete ( "HKEY_CURRENT_U SERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplor er")
* WSH.RegDelete ( "HKEY_CURRENT_USER SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerN oSetFolders")
* WSH.RegDelete ( "HKEY_CUR RENT_USERSoftwareMicrosoftWindowsCurrentVersionPolicies ExplorerNoFolderOptions")
* WSH.RegDelete (& q uot; HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVer sionPoliciesExplorerNoTrayContextMenu ")
* WS RegDelete H. ( "HKEY_CURRENT_USERSoftwareMicrosoftWin dowsCurrentVersionPoliciesExplorerNoViewContextMenu & quo t;)
* WSH.RegDelete ( "HKEY_CURRENT_USERSoftwa reMicrosoftWindowsCurrentVersionPoliciesExplorerNoSaveS ettings")
* WSH.RegDelete ( "HKEY_CURRENT _USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExpl orerNoRecentDocsMenu")
WSH.RegDelete * ( "; HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersio nPoliciesExplorerNofind")
* WSH.RegDelete (& q uot; HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVer sionPoliciesExplorerNoRun ")
* WSH.RegDelete ( "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentV ersionPoliciesSystemDisableTaskMgr")
* WSH.R egDelete ( "HKEY_CURRENT_USERSoftwareMicrosoftWindow sCurrentVersionPoliciesSystemDisableCMD")
* WSH.RegDelete ( "HKEY_CURRENT_USERSoftwareMicrosoftW indowsCurrentVersionPoliciesSystemDisableRegistryTools & quot;)
* WSH.RegDelete ( "HKEY_LOCAL_MACHINESO FTWAREGoldenGhost.A")


Delete the file and the parent virus duplicate files by using the search windows to show hidden files. If the folder option and the search has not been shown, then restart / logoff the computer first.

Once the file is found, delete the file that has the size 1.312 KB. addition, remove the file:
- Devil.ocx = 1 KB
- Pluto.ocx = 1 KB
- GoldenGhost.exe = 1 KB
Remove the string @ echo off on the file [C: Autoexec.bat]
Remove string GoldenGhost -= =- Was Here on file [C: boot.ini]
Restore Host File Windows by using the tools Hoster (http://www.4shared.com/file/62290120/73265114/Host sXpert.html? DirPwdVerified = feea1d94). To merestore windows host file, click the "Restore MS Hosts File" on HosterExpert these tools.

If you use Norman antivirus / McAfee / Kaspersky should re-install the antivirus and then scan the computer to make sure the computer is completely clean of viruses. Update Norman Security Suite is also able to improve any of the files that diinjeksi by W32/Agent.GYMR.

Twitter Delicious Digg Facebook Stumbleupon RSS