How to Remove Virus shortcut Harry Potter

How to Remove Virus shortcut Harry Potter ?
Searched on facebook friend complained that her computer was attacked Shortcut virus, a type virus harry potter, there is no harm in me trying to give a little review and how to eradicate this virus.
Your computer (Windows XP with this particular) have a virus / malware folder shortcut harry potter ... lnk, microsoft, new folders steps Insha Allah I will give below can help overcome them.

According to my analysis of how the virus / malware is as follows:


* Virus / malware will put the file database.mdb, thumb.db, Autorun.inf, folder shortcut harry potter .... Lnk, folder shortcut microsoft, new folders and shortcuts on my document folder.
* Virus / malware will enable the file wscript.exe and thumb.db files residing in the folder windows system32 folder to run database.mdb files on my document.
* Shortcut folders had to be linked to files thumb.db.
* If you open this shortcut folders it will activate the file and the file wscript.exe thumb.db and will create a duplicate of an existing shortcut folder on your computer, thumb.db file and the autorun.inf file on all drives C.
* If your computer is virus / malware was then the whole drive C: you will have duplicate an existing shortcut folder on your computer, thumb.db file and the autorun.inf file. A scan will also drive, CD ROM, flash and your network as a medium of spreading the virus / malware.

There are two methods to remove the virus.

Method 1 by using an updated antivirus. Antivirus which can recognize the virus (author only has this antivirus 3), namely: 1. AVG: detected as VBS Worm. AVG will delete all the duplicate shortcut folders and files of the virus earlier.
2. Norton Antivirus 2009: detected as VBS Runauto. Norton will delete all files on drive C. thumb.db You can delete the Autorun.inf file and all copies of the shortcut folder manually.
3. Avira Antivir Premium: detect it as malware DR / Agent.JP.
4. Antivir will delete all files on drive C. thumb.db

You can delete the Autorun.inf file and all copies of the shortcut folder manually. Method 2 with the manual method. 1. Turn off System Restore.
2. Turn off the process wscript.exe virus using tools CProcess / CurrProcess (you can download via google). Run CProcess, search on name wscript.exe process tab then right click and click the kill procesess selected.
3. Open windows explorer, click tools menu options, folder options, view, click Show hidden files and folders, click / uncheck the Hide extensions for Known file types and Hide protected operating system files.Klik OK.
4. Open My Documents. Delete files database.mdb.
5. Click the Search button. Click All Files and Folders. In the All or part of the file name type: thumb.db, click on the Look in my computer. Delete all files that have been found. Repeat the steps above and delete all files that are found again.
6. Click the Search button. Click All Files and Folders. In the All or part of the file name type: Autorun.inf, click on the Look in my computer. Delete all files that have been found. Repeat the steps above and delete all files that are found again.
7. In step 6 actually a virus is gone or no longer active but there are still remaining duplicate shortcut folders created by virus / malware was.
8. If you want to eliminate them, you must be careful at all between the shortcut created by the virus with congenital shortcut on windows. Key features of the shortcut folders created by a virus that is when we appoint these folders will display a link from the shortcut that is in the direction Windows/System32. That we have to delete the shortcut.
9. How to find the folder shortcut: Click the Search button. Click All Files and Folders. In the All or part of the file name type: *. lnk, click on the Look in my computer. You should choose based on the characteristics of the shortcut folders created by the above virus.
10. You can delete the registry created by this virus using HijackThis tool. (Can download via google). Click Scan only and search system in the HKCU \ ... \ ... database.mdb, HKLM \ ... \ .... associated with windowsxp cd (I forget the name of its length, this is also for that but sometimes there are sometimes not), also HKCU \ ... \ .... disableregedit = 1. click the button fixed.
11. Now restart your computer. Actually if we do not delete the registry last (step 10) is not a problem, but at the time of restart windows will display two dialog boxes are essentially the first to find the file that we remove this database.mdb, who both asked to enter the cd windowsxp. click Ok aja uda ga problem. Then we'll likely regedit was disabled by a virus. This is also problematic if you ga ga brain often manipulated the windows registry. Method To counteract the virus comes back

This virus works if we click the new folder shortcut harry potter, microsoft. After we click the shortcut folder then he will find a file that is located in the folder wsript.exe windows system32 folder. With active wscritp.exe the virus will start spreading. So the key to active the virus is in the file wscript.exe. For that we have to turn off the road renaming wscript.exe.

The trick is:

1. Open windows explorer, click tools menu options, folder options, view, click Show hidden files and folders, click / uncheck the Hide extensions for Known file types and Hide protected operating system files.Klik OK.

2. Open the folder C: \ Windows \ system32 \ dllcache. Folder is a collection of backup files from the files in the System32 folder. Find the file wsript.exe then right click to rename eg wscriptx.exe. Then open the C: \ Windows \ system32, find the file then right click rename wsript.exe such a wscriptx.exe too.
Thus my explanation of the shortcut virus, may be useful