How to eradicate virus Shortcut (Pif / Starter)

Yesterday a friend who took the data in the computer through my USB Flash Disk. As a precaution, first I scan with Avira antivirus and Ansav Free Edition, the process of scanning and running there was some virus that was detected by Ansav. Then after I remove / delete all the files infected viruses. In fact there is a file detected as virus

ie autorun.inf, Microsoft.inf and Thumb.db. The virus makes the duplication of each folder with the shortcut type.

After I clean it and then the USB time data copy my friend earlier. When you open the file in a folder that has files appear virus (autorun.inf, Microsoft.inf and Thumb.db), my conclusion was computer virus fell ill from a USB Flash Disk from variants Pif / Starter. To remove the virus could not be that easy. After a full scan and delete the files but the virus is still only appear in each folder.

Of mind is not how I try to eradicate this virus shortcut in the internet and following the steps it takes to eradicate the virus shortcut (Pif / Starter) quoted from Detikinet:

1. Turn off the system restore first, I right-click My Computer | Properties, Select the tab System Resotore, check the box small System Restore Turn off all the drive.

2. Turn off the process of Wscript file located in C: \ Windows \ System32, with how to use tools such as CProcess, HijackThis or can also use the Task Manager of Windows.

3. Once off the process of Wscript, we must menhapus or me-rename the file so that's not to be used by the virus.

As a note, me-if we rename the file from Wscript.exe with the automatic, it will be copied again in the folder. Therefore, we must find where the file Wscript.exe the other, usually in C: \ Windows \ $ NtServicePackUninstall $, C: \ Windows \ ServicePackFiles \ i386.

No virus-like virus vbs other, we can change the Open With from the vbs file into Notepad, the virus berextensi this means is that mdb file Microsoft Access. So Wscript akan DATABASE.MDB run the file as though he is a vbs file.

4. Delete the files in the parent C: \ Documents and Settings \ \ My Documents \ database.mdb, so that every time the computer will not run load the file. And do not forget we are also open msconfig, disable the run command.

5. Now we will delete the files Autorun.INF. Microsoft.INF and Thumb.db. How, click the START button, type CMD, moved to the drive will be cleaned, for example, drive C: \, then we should do is:

Type C: \ del Microsoft.inf / s, this command will delete all files microsoft.inf in all folders on drive C:. While the move would drive changed the name to live course drivenya example: D: \ del Microsoft.inf / s.

For the autorun.inf file, type C: \ autorun.inf del / s / ah / f, the command will delete the file autorun.inf (syntax / ah / f) is used because the file using the attrib RSHA, as well as to file Thumb . db also do the same.

6. To men-delete files earlier than the 4 files, we must find ways to search files with the extension. Lnk size 1 kb. In the 'More advanced options' option make sure that' Search system folders' and 'Search hidden files and folders' both are checked.

Please be careful, not all the shortcut files / LNK file size of 1 kb that is a virus, we can distinguish it from the icon, size and type. To create a shortcut icon for the virus using icon 'folder', and the size of 1 kb bertipe 'shortcut'. While the correct folder should not have 'size' and the type is' File Folder '.

7. Fix the registry is modified by the virus. To speed up the process of repair registry copy the script below on the program 'notepad' and save it with the name 'Repair.inf'. Run the file in the following manner:

- Click right repair.inf
- Click Install

[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee

[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del

[UnhookRegKey]
HKLM, Software \ CLASSES \ batfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ comfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ exefile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ piffile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ regfile \ shell \ open \ command,,, "regedit.exe"% 1 ""
HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"
HKLM, SYSTEM \ ControlSet001 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SYSTEM \ ControlSet002 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"

[del]
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, Winupdate
HKCU, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, explorer