Recently, my laptop was infected with the W32/Mabezat worm after using a infected Flash memory Drive. I had shut down my AntiVirus software(was using nod32) to liberate some memory and forgot to restart it.

Anywayz, this worm was really bad and started replicating itself everywhere. So here’s the steps i took to remove it

1. Temporarily Disable System Restore (Windows Me/XP)
2. Update the virus definitions.
3. Reboot computer in SafeMode
4. Run a full system scan and clean/delete all infected file(s)5. Delete/Modify any values added to the registry.
Navigate to and restore the following registry entries to their
original values, if required:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
\”ShowSuperHidden” = “0?

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download this file(UnHookExec.inf) from Symantec. Right-click the file and click install.
6. Exit registry editor.7. Find and delete the following files:
- %SystemDrive%\Documents and Settings\tazebama.dl_
- %SystemDrive%\Documents and Settings\hook.dl_
- %UserProfile%\Start Menu\Programs\Startup\zPharoh.exe
- %SystemDrive%\Documents and Settings\tazebama.dll
- [DRIVE]:\zPharaoh.exe
- [DRIVE]:\autorun

8. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.

Posted in Security | Leave a Comment | No Comments »

Want to check if your antivirus is working? Think your antivirus has been compromised?

Follow this simple guide to test your antivirus

Create a new text file, in the text file enter:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Now save the file as anything.COM (the com extension is important as this is an executable)

Any decent antivirus will have detected a threat as soon as you saved the file, if yours hasn’t then try executing the file (this file will NOT harm your pc) or manually scanning the file.

If your AV detects something then it’s working fine, if it doesn’t, i would recommend looking for a new AV.

This file will not harm your pc in any way, it is a string created by the antivirus industry to test the integrity of antivirus’s.

Posted in Security | Leave a Comment | No Comments »