/virus/virus_java.dll

Virus Removal Techniques

Special Case: Remove java.dll

Initial Symptoms:

  • Internet Explorer browser hangs
  • Computer slow down
  • The temporary folder shows the following files %MS%HCopy.tmp which cannot be deleted
    i.e.
    %System%\%MS%HCopy.tmp
    %System%\%MS%UCopy.tmp
  • Click here to see its screenshot
  • Computer restarts frequently, the XP (blue) theme changes into Classic (pale yellow) theme before restarting
  • The blue dead screen prompts
  • When inserting the infected removable drive in the system, the old folders are automatically hidden while making visible to the exe files with the same name as of the folder and their icons.

Source:

Infected Removable drives

Removable drive doesn't contain Recycler folder by default. But the compromised removable drive contains this.

Precautions:

  • Turn off the autoplay features on the removable drives (Try Tweak UI)
    Click here to see how to turn off autoplay features using Tweak UI
  • In the sytem with autoplay enabled hold the shift key when inserting the pen drive to bypass the autoplay features
  • Remove the recycler folder and the autorun.inf from the removable drive

CURE

  • Disable the system restore on all the drives
  • Remove the three files
    %System%\mfc48.dll
    %Windows%\java\classes\java.dll
    %System%\kernel32.sys
  • Use the free commander to view all the files with ease and to delete them
  • Unhook the entries made by java.dll and mfc48.dll using tool autorun or tool Hijackthis
  • Update the antivirus program
  • Run the full scan
  • Remove the recycler folder and the autorun.inf from the removable drive and from the command prompt type to view the original hidden folders by typing X:\dir/ah where X: is the location of the removable disk. Click here for more on unhiding the hidden folders from command prompt

Once the system is infected, the antivirus program can detect the virus, but can neither delete nor quarantine the virus from the system. Moreover the system file protection does not allow the easy deletion of the above file mentioned. Therefore they should be deleted from another system.

The detailed information on this virus can be obtained from http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=63475



Free Web Hosting