Author Topic: new worm? spyware? need reply  (Read 4217 times)

0 Members and 1 Guest are viewing this topic.

zhon

  • Guest
new worm? spyware? need reply
« on: September 18, 2007, 05:08:55 AM »
guys check this out! me and my friends got this virus or i really dont have any idea as it seems harmless(???!) under the right click drop down menu of every hdd, partitioned hdd, usb flashdrive and sh_T!!! including my ipod has an extension name of  (img kulot) on the open and explore function   ???. please i need help here.
« Last Edit: September 18, 2007, 08:39:27 AM by zhon »

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: new worm? spyware? need reply
« Reply #1 on: September 18, 2007, 09:44:29 AM »
Hi zhon,

There is some advice here in English and another language, maybe yours, I don't know:

Quote
How to delete the ing(kulot) virus safely:

1. Have your PC display the contents of the system folder
and hidden files.
2. delete all the img(kulot) files and the autorun.inf


Do this also to all removable drives such as flash drives....

The virus also does not infect windows vista.....

http://ww.pcx.com.ph/forum/display_topic_threads.asp?ForumID=3&TopicID=27213&PagePosition=1

Before you do this, please send a copy of the virus to virus[at]avast.com in a password protected archive- mention the password in the body of the email.

Alternatively, open the virus chest, select user files, add the two file and send to avast from there.

You could also send the files to VirusTotal.com. This will show what other scanners might be picking up the infection and thus be able to remove it.
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

zhon

  • Guest
Re: new worm? spyware? need reply
« Reply #2 on: September 19, 2007, 08:36:08 AM »
thanks freewillin frank

zhon

  • Guest
Re: new worm? spyware? need reply
« Reply #3 on: September 21, 2007, 09:30:48 AM »
At last!!! I have found the solution to the worm i found, freewillin frank thanks for the help but somehow i wasnt able to completely remove the script like what you've told me. well actually the process was a bit the same but this is the complete procedure.

to remove the vbs script virus
1. stop the process at the task manager (ctrl+alt+del), look for wscript.exe and click end process.
2. run msconfig and go to startup tab, look for any services that has the name imgkulot.bat and click disable
    if you can't find imgkulot.bat thats ok close msconfig and proceed to step 3.
3. search your hard drive(s) for the files imgkulot.vbs, imgkulot.reg and imgkulot.bat Using the search function when you right click the drive make your you have unhide system files and under the advanced option of search check the box "search system folder" and "search hidden files and folders".

WARNING!!! DO NOT MANUAL SEARCH THE ABOVE FILES, DOING SO WILL EXECUTE THE AUTORUN.INF AND WILL RUN THE SCRIPT AGAIN
                 (every time you hit double click one of your drives that is infected by the script the autorun.inf will execute if you accidentally did repeat step 1.)

4. if you have found the imgkulot files as mentioned above delete everything there are files that needs their properties to be changed prior to deleting, uncheck the box "read only file" for you to delete it.

5. after deleting the imgkulot files search the whole hard drives again for the autorun.inf change the properties of the file if ever you cant delete it. then delete all files
6.hope this help :-)

zhon

  • Guest
Re: new worm? spyware? need reply
« Reply #4 on: September 21, 2007, 09:39:05 AM »
....

CharleyO

  • Guest
Re: new worm? spyware? need reply
« Reply #5 on: September 21, 2007, 10:23:26 AM »
***

Welcome to the forum, zhon.    :)

We are glad you found the solution to your problem.
Thank you for posting what worked for you and perhaps it will help someone else.

Please come back often, learn more, and maybe help others.    :)


***