To Solve VirusMawar
UDM_StrikesBack or ViRusMaWar
What are the symptoms that shows your computer have been affected by UDM_StrikesBack or ViRusMaWar :
1) Task Manager have been disabled
2) Folder Option have been disabled
3) Regedit have been disabled
4) Search have been disabled
5) You can find UDM_StrikesBack.html in all your partition drive
6) Your Internet Explorer browser shows title "VirusMawar menguCapKan SelAmaT TaHun BaRu Cina, Terutama kpd WarGa UDM+++"
7) System properties, registered to : MawarKu
What you should do to remove this virus :
1) Go to Run then type cmd
2) Paste this line in command window
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
3) Again, go to Run type regedit
4) In Registry editor find keyword "disabletaskmgr" then modify it to 0
5) in Registry editor find keyword "Mawar" then delete all (to many)
6) Open your Task Manager and stop all process with name "wscript.exe"
7) Search for keyword "nofolderoption" then modify it to 0
8) You also may found keyword "NoFind" there, do same thing as before, modify it to 0
9) type msconfig on run, click startup, uncheck startup item for MawarKu.
10) Open your Folder Option and in View tab, check for show hidden files and uncheck hide operating system files
11) Now you can delete the virus with name "ViRusMaWar3.js" which located in location such as "C:\WINDOWS\system32" , and all partition drive in your computer (ex partition c or e:).
12) You also need to delete files named "Autorun.inf" and UDM_StrikesBack.html file in every partition drive and removable drive that have been connected with your PC before.
13) Lastly restart your computer and remember to restore back your Folder Option to previous setting.
What are the symptoms that shows your computer have been affected by UDM_StrikesBack or ViRusMaWar :
1) Task Manager have been disabled
2) Folder Option have been disabled
3) Regedit have been disabled
4) Search have been disabled
5) You can find UDM_StrikesBack.html in all your partition drive
6) Your Internet Explorer browser shows title "VirusMawar menguCapKan SelAmaT TaHun BaRu Cina, Terutama kpd WarGa UDM+++"
7) System properties, registered to : MawarKu
What you should do to remove this virus :
1) Go to Run then type cmd
2) Paste this line in command window
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
3) Again, go to Run type regedit
4) In Registry editor find keyword "disabletaskmgr" then modify it to 0
5) in Registry editor find keyword "Mawar" then delete all (to many)
6) Open your Task Manager and stop all process with name "wscript.exe"
7) Search for keyword "nofolderoption" then modify it to 0
8) You also may found keyword "NoFind" there, do same thing as before, modify it to 0
9) type msconfig on run, click startup, uncheck startup item for MawarKu.
10) Open your Folder Option and in View tab, check for show hidden files and uncheck hide operating system files
11) Now you can delete the virus with name "ViRusMaWar3.js" which located in location such as "C:\WINDOWS\system32" , and all partition drive in your computer (ex partition c or e:).
12) You also need to delete files named "Autorun.inf" and UDM_StrikesBack.html file in every partition drive and removable drive that have been connected with your PC before.
13) Lastly restart your computer and remember to restore back your Folder Option to previous setting.
Comments