how to cure the autorun.5555 virus
treatment can be quite difficult - since it is a worm and on old operating systems it spreads over the network.
1. it reproduces by infecting autorun on the flash drive, with its body in a folder in the recycle bin
2. the body is located in dll and gif files
3. access to all antivirus sites and the microsoft site is blocked
4. periodically there is significant network activity on all computers on the local network, one of the computers of which is infected with the virus
5. no access to task manager (registry editing is prohibited by the system administrator)
6. no access to the registry (registry editing is prohibited by the administrator)
7. the host file is often not modified
8. the routing branch in the registry is also often not modified
9. when trying to enter safe mode the computer restarts itself
Treatment:
1. disconnect the computer from the local network
2. clean the computer with Dr.Web CureIt! utility and the AVZ utility from Kaspersky Lab
3. enable task manager:
command : "cmd /k reg delete HKCUSoftwareMicrosoftWindowsCurrentVersionpolicies /ve /f".
4. open access to the registry :REG DELETE HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableRegistryTools /f
5. or try via group policy:
1. Click the "Start" button - "Run";
2. In the "Open" field type the command gpedit.msc and click "OK";
3. In the left part of the "Group Policy" window, successively expand the sections down to the "System" subsection;
Policy "Local Computer" –> "User Configuration" –> "Administrative Templates" –> "System"
4. Left-click on the "System" section and in the right part of the window find the policy "Prevent access to registry editing tools";
5. Right-click on this policy and select the "Properties" menu item;
6. Go to the "Setting" tab and select "Not Configured";
7. Click the "OK" button and restart the computer;
if that did not help then download an alternative registry editor and remove the DisableRegistryTools parameter-
- Registrar Registry Manager;
- Witap Registry Explorer;
- RegWorks;
found another loophole that this virus uses - disabled the DNS Client service in administration - thereby cleared the DNS cache... immediately access appeared to the blocked microsoft sites, antivirus sites - such as dr.web, kaspersky, avast
or run the command ipconfig /flushdns
and you can view the DNS cache like this: ipconfig /displaydns
Comments