Win32.Elkern A/B/C - Download Remover

Download the following three files ( rmelkern.exe, rmvirus32.nt, rmvirus.dos) and run the rmelkern.exe file.

You can also specify the disks (or partitions) to heal as a command parameters, e.g. : "rmelkern C: D: ". If the command is used without parameters, it heals all disks (partitions) on computer.

Successful running of the removerrequires administrator rights. For proper functionality of the remover it is necessary to save the rmvirus32.nt and rmvirus.dos into the same folder as rmelkern.exe. After the healing process please run the rmelkern.exe again to make sure your computer is virus-free.

Download the following three files here:

rmelkern.exe

rmvirus32.nt

rmvirus.dos

Worm.Lovsan

When the timeout message appears that you will be disconnected in some time period, please click on START button -> RUN and type this command here:
SHUTDOWN -a
and click OK then. The timeout will be stopped then and you will be able to download and install the security patch to your operating system.

• You have to download and install the security patch to your operating system first (it repairs a bug in the DCOM RPC). You can find it on Microsoft internet pages.

• Run the registry editor (START -> RUN -> type REGEDIT and click on OK button) and find this registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

• Please right click on the name "windows auto update" and choose REMOVE/DELETE.
• After this please reboot your computer to the "Save mode with command prompt" and type here these commands:
  CD WINDOWS (enter)
  CD SYSTEM32 (enter)
  DEL MSBLAST.EXE (enter)
• Then run your antivirus likes AVG, MSE, or Avira to complete remove virus and check virus.
  

I-Worm/Bugbear.C - Removal Tool

Download the remover rmbugbear.exe and run it on infected computer. Then restart your PC normally and run the rmbugbear.exe.

If the infected computer is connected to LAN, it is neccessary to disconnect this computer from LAN before removing the virus and re-establish the connection in the moment when ALL computers in LAN are cleaned.

Exceptions:
If you are using Windows ME or Windows XP operating systems, there might be a problem in removing infected files from the _Restore folder (Windows ME) or System Volume Information folder (Windows XP). For the correct removal of these infected files, it is necessary to disable the system restore function.

download removal tools here:

remover rmbugbear.exe

Vcleaner (Virus Cleaner)

Download the remover (Vcleaner) vcleaner.exe. Restart your computer in Safe mode and run the remover on the infected computer. Vcleaner removal utility will detect and remove following viruses:

• I-Worm/Stration
• Worm/Generic.FX
• Agent.A-AN
• BackDoor.Agent.A-Z, AA-BG
• Downloader.Agent.AS
• I-Worm/Atak.A-I
• Bagle.DA-IU
• I-Worm/Bagle.A-Z, AA-JD
• I-Worm/Bugbear.D
• I-Worm/Mytob.A-GC
• I-Worm/Netsky.A-Z, AA-AD
• I-Worm/Sasser.A-F
• I-Worm/Zafi.A-E
• PSW.Bispy.A-E
• Win32/Gaelicum
• Win32/Hidrag

Note: Some viruses can stop the action during the removal process. In this case rename the vcleaner.exe to some different exe file (e.g. something.exe). Restart your computer in Safe mode (recommended) and run the remover on the infected computer.

download vcleaner here:

Vcleaner.exe

SVX Backdoor (LOP.AH/Backdoor.Generic3.SVX) - Trojan Remover

Download two files (rmbg3svx.exe and rmbg3svx.nt) and run the rmbg3svx.exe file (Trojan Removal Tool). Then restart your PC normally and run rmbg3svx.exe.

Successful running of the trojan horse remover requires administrator rights. For proper functionality of this free removal tool it is necessary to save the rmbg3svx.nt into the same folder as rmbg3svx.exe.

download the following two files :

rmbg3svx.exe

rmbg3svx.nt

Virus:W32/Alman.A

Name : Virus:W32/Alman.A
Detection names : Virus.Win32.Alman.a
Category : Malware
Type : Virus
Type : Net-Worm
Platform : W32


Details

Registry Modifications :
Creates these keys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RioDrvs
DisplayName = "RioDrvs Usb Driver"
ImagePath = "system32\Drivers\RioDrvs.sys"

Virus:W32/Alman.A infects all executable files in the system. The virus propagates over a network. It also has rootkit capabilities and is capable of contacting a remote server to forward information about the infected system.

A later variant of this virus, Virus:W32/Alman.B is also in the wild.

Variants of this family may be detected by the Generic Detection, Virus:W32/Alman.gen!A.


Infection

Alman.A infects all .EXE files in the affected system. It appends its code to the target file and sets this as an additional code section. It searches for files to infect in all fixed, shared, and removable drives.

It skips infecting files located in the following directories:

• Local Settings\Temp

• Windows

• WinNT

Execution

Upon execution, this network-propagating virus drops the following files:

• [Windows Directory]\linkinfo.dll - infector component

• [Windows System Directory]\drivers\DKIS6.sys - rootkit component

• [Windows System Directory]\drivers\RioDrvs.sys - rootkit component

The dropped file RioDrvs.sys is registered as a service. The file linkinfo.dll is injected into explorer.exe and is hidden by the rootkit components.

This virus terminates processes with names that match the following strings:
c0nime.exe,cmdbcs.exe, ctmontv.exe,explorer.exe,fuckjacks.exe, iexpl0re.exe,iexplore.exe,internat.exe,logo_1.exe,logo1_.exe, lsass.exe,lying.exe,msdccrt.exe,msvce32.exe,ncscv32.exe,nvscv32.exe, realschd.exe,rpcs.exe,run1132.exe,rundl132.exe,smss.exe,spo0lsv.exe, spoclsv.exe,ssopure.exe,svch0st.exe,svhost32.exe,sxs.exe,sysbmw.exe, sysload3.exe,tempicon.exe,upxdnd.exe,wdfmgr32.exe, wsvbs.exe.

However, the path of the files associated with the above mentioned processes should not contain the following strings:

• \com\

• \program files\

• \system\

• \windows\

• \winnt\

Once the process is terminated, the corresponding file is also deleted.

You Can Download Win32/Alman here : (Download the following two files)
Alman Removal.exe
Alman Removal.nt

You can also specify the disks (or partitions) to heal as a command parameters, e.g.: "rmalman C: D:". If the command is used without parameters, it heals all disks (partitions) on computer.

Note:
Successful running of the remover requires administrator rights. For proper functionality of the remover it is necessary to save the rmalman.nt into the same folder as rmalman.exe. After the healing process please run the AVG Complete Test to make sure your computer is virus-free.

Win32.Tanatos

Win32.Tanatos.M, also detected as Tanatos.M is a harmful worm threat that infects Windows operating system. Generally, Win32.Tanatos.M is installed after clicking on annoying adsin spam e-mail or via pornographic related sites and P2P downloads. After infecting the
computer Tanatos worm will use exploit to disable security and drop harmful Dll and Exe
files into Windows system. The Win32.Tanatos.M worm is a critical security risk!

Aliases / Asociated Infections:
Win32/Tanatos, Win32.Tanatos.k, Win32.Tanatos.l, Win32.Tanatos.b.dam, Win32.Tanatos.b, W32/Bugbear.gen@MM, W32/Bugbear-B, Win32.Tanatos.p, Trojan.PWS.Hooker, I-Worm/Bugbear.G, Win32.HLLM.Bugbear.2, Win32.BugBear.1.Gen@mm, Win32.Tanatos.c,W32.Bugbear@mm, Worm/BugBear.B.dll, Win32.Tanatos.r

Symptoms of Win32.Tanatos.M worm threat:

* Abnormal Tanatos.M malware files running in system task manager, endless tower speaker beep sounds
* Corrupt system files, registry keys and dlls files causing "Blue Screen Of Death"
* Desktop screen saver and background picture hijacked by irritating messages
* Pc flooded with irritating adult related pop-ups, inactivated pop up blocker tool
* Redirected search engine results and Web browser home page
* Especially difficult to delete Tanatos.M manually, repair and reactivate its files after manual erasure
* Decreased Internet bandwidth, sluggish connection and surfing speed

Behaviors of Win32.Tanatos.M:

* Tanatos.M infects Windows system through security holes via e-mail attachments, messenger and freeware programs
* Tracks system activity and registry settings, tracks surfing activity to generate equivalent popup advertisements
* Infects system in stealth mode to bypass antivirus and firewall programs and sends private financial records to outlying hackers

You can Download Tanatos Removal :
Tanatos Removal

This virus removal tool helps you with Win32/Tanatos infection - A, H, I, M variants

If the infected computer is connected to LAN, disconnect it and re-connect only after all other computers have been checked and cleaned.

Download Tanatos Removal.

• Then run the tool for removal of infected files. The tool will automatically scan all available discs and will try to heal the infected files. If an active virus is found in memory, the tool will ask the user to reboot the computer. Healing will be performed during operating system boot-up sequence, so any active virus cannot interfere with the healing process.

• Update you AVG if you have after restart and run a complete test.