marky_bewitched's Blog: How to remove pooh.vbs from your system or flash drive

Advisory:

Meet the new Design. Pardon any small glitches.

How to remove pooh.vbs from your system or flash drive

Monday, September 24, 2007

Credits to PC Express Online and stardestiny for the fix

I've finally learned how to kill it... but first an intro...

I got this virus in a internet cafe in Cebu, Philippines

It exploits the autorun feature in memorycards and copies itself to computers and connected memory cards thereafter

Because it does not spread itself to the internet, it hasn't gained enough notoreity to be included in virus defenses of various programs

Be sure to also clean your infected memory cards...

Here's how you clean it:

Download startup control Panel at mlin.net (You're going to use this later)

Go to your Task Manager (Ctrl+Alt+Del)
Terminate the Wscipt.exe process
Terminate the Explorer.exe process

Click New Task and Type "cmd" (without the quotes)

type the following in your command prompt

del c:\pooh.vbs /f/s/q/a del d:\pooh.vbs /f/s/q/a(include your other drives and USB drives that have been infected)

del c:\autorun.inf del d:\autorun.inf(include your other drives and USB drives that have been infected)

del c:\windows\system32\kernell.dll.vbs del c:\aikelyu.html /f/s/q/a
Use the start-up program from mlin.net to remove aikelyu.html on windows startup

Go to New Task and type "regedit" (without the quotes)

Go to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and modify it to make the value in Shell to only contain "explorer.exe"

That's about it... Good luck everybody...

Oh yeah... to the creator of the virus... "Jayker"... go f*ck yourself

further readings:

Here

to Jayker:

You're Sore Loser!

Labels: Security, Virus

posted by marky_bewitched at 11:34:00 AM

6 Comments:

Joseph Librero said...

Thanks man..
I had this virus in my flsah drive MP3 player and laptop. hehehehe
VGA can't remove it...

Our church PC is also infected.. Thanks! this will really help. God bless you!!

Monday, October 01, 2007 8:44:00 AM

Unknown said...

deleted all pooh.vbs and autorun.inf file on all drives except one. it seem that you have to right click to open the drive and cant do it with double clicking. it still has autoplay when you right click to reveal window for option but no autorun.inf file is seen. can you help me bro. too much hassle on my part since i often use that drive. thanks in advance!

Wednesday, October 03, 2007 8:44:00 AM

marky_bewitched said...

@all
Thanks!

Wednesday, October 03, 2007 7:26:00 PM

TYrOne said...

wee thanks dude...
it really worked. the virus is now out of my sytem...
one more thing though how do you possibly remove the virus from a flash disk drive?????

Sunday, November 18, 2007 2:43:00 AM

marky_bewitched said...