Worm removal - Funny UST Scandal.avi.exe


One of the viruses which i have tackled off late is Funny UST SCandal.avi.exe

Some of the Symptoms Of Funny UST SCandal.avi.exe are

• A orange icon with image of a Foot.
  
• Files missing, Not able to view hidden files.
  
• Every time you click on My Computer opens a new instance of it.
  
• Task Manager automatically disappearing after few seconds, not able to view process.
  
• System deadly slow
  
• Installations not occurring.
  

If your case can be matched with the conditions given above, in all probability, you’ve got the Autoit.BD worm, better known by Funny UST Scandal.avi.exe. AVG, Norton, Avast! - all don’t detect the virus.This Virus replicates itself on the various disk partitions. So even if you have deleted it from C:\ or formated your PC it will still persist in some other partition leaving you in the same dilemma again. So one of the best ways to tackle this is.....
Steps to Follow in order to remove it

1. Download and install [ندعوك للتسجيل في المنتدى أو التعريف بنفسك لمعاينة هذا الرابط]. TaskKiller forcefully kills the task and hence stops virus from replicating. Run Task Killer, and a red skull icon will appear on the system tray.Left click it, and click Processes
   
2. Select to kill these processes -
   
   
   
   • killer.exe
     
   • lsass.exe
     
   • smss.exe
     

Now open up Command Prompt (Start>Run>command). Type each command and press Enter to run it -

• cd\
  
• attrib -h -s smss.exe
  
• attrib -h -s autorun.inf
  
  

Open My Computer and go to "C:\", then "C:\Windows\System32" and "C:\Windows\System".

Delete the following files -

• smss.exe
  
• autorun.inf
  
• Funny UST Scandal.avi.exe
  

Now, go to C:\Documents and Settings\All users\Startmenu\Programs\Startup and delete the file lsass.exe.

Open Registry Editor (Start>Run>regedit)

Delete the key HKEY_LOCAL_MACHINE\Software\
Microsoft\WindowNT\CurrentVersion\Winlogon=shell(killer.exe

Delete the key HKEY_CURRENT_USER\Software\
Microsoft\windows\Currentversion\Run=runonce(c:\windows\smss.exe)

Check For the virus in the other root partitions and remove the Funny UST Scandal.avi.exe