This time-bomb virus will deleted all your data in your hard-disk and flash-diskÂ including system files for each file founded on date 12-13 around 8-9 AM each month. If you got this message in your computer then you have infected by this Deadlock Virus.
This virus has strange master files, I don’t know why this virus creator choose apache.exe (popular web server) and mysql.exe (popular database) if users familiar with computer process they will found out this master files easily. Deadlock has been compressed by petite 2.x. with size 80KB, using application icon.
No autorun.inf, Deadlock using desktop.ini then folder.htt to execute flashguard.exe, so… if you’re infected by this virus each folder will contains this 3 files.
This virus will deleted all files, not only data or document, virus will removing them all. If this happen to you I really don’t have smart solution for this… You can try using recovery programs, badly this programs not free. Maybe you can try to searching for free recovery programs, Anyway in my experience not all recovery programs working 100% sometimes you can’t get back lost files in 100% if you lost it in long time ago (ex: 1 year ago).
Virus also will deleted system files and make your computers fails to start, consult with your OS vendor how to fix this (In windows XP there is repair tools from CD but don’t know other) if there is no repair tools you have no choice to reinstall your OS then recover back your lost files.
HOW TO:Remove DeadLock Virus Manually:
1. Disable System Restore when in cleaning process.
2. Kill active virus in computer background, use process explorer kill process with name “apache.exe” and “mysql.exe“.
3. To prevent virus active back when you’re in cleaning process I suggest you to register this files into “software restriction police“.
Start -> Run -> Type “SECPOL.MSC” then following this images after that apply to make sure this new rules working.
NOTE: If you’re not using Windows XP Professional,2003 server,vista,2008 you can skip this step.
4. Repair your registry using repair.inf right click on files then click install.
HKLM, Software\CLASSES\batfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”””%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\ControlSet002\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer, NoDriveTypeAutoRun,0x000000ff,255
HKCU, Software\Microsoft\Windows\CurrentVersion\Run, apache
HKLM, Software\Microsoft\Windows\CurrentVersion\Run, mysql
5. Delete Master files on:
6. Scan with updated antivirus programs to make sure your computer clean, you can use Norman mallware cleaner for free, download it from here.
DONE, if you meet problem let’s discuss it in here
- HOW TO: Remove Facebook Virus W32/Obfuscated.D2!genr
- Remove W32/VBWorm.QXE (bulubebek)
- Remove virus AMBURADUL (all varian)
- Remove MaHaDeWa VBS.Autorun.AM
Related Search Terms:
- vprotect application has encountered a problem and needs to close (28)
- VProtect Application has encountered a problem (26)
- VProtect Application has stopped working (25)
- smartp exe no disk (10)
- atasi virus window no disk (9)
- cara menghilangkan smartp exe no disk (9)
- vprotect application has encountered (8)
- windows no disk virus (6)
- vprotect application (6)
- deadlock (6)
- how to fix vprotect (5)
- virus creator (5)
- cara menghilangkan svchost exe (5)
- cara menghilangkan smartp exe (4)
- bagaimana mengatasi write protection pada komputer (4)
If you're new here, you may want to subscribe to my RSS feed. You may copy or publish this article to your blog or other site as long you give credit link back to this site article. Thanks for visiting my blog!
8 Responses to “Remove DeadLock Virus (W32/Tibs.DKKR)”
- Remove DeadLock Virus (W32/Tibs.DKKR) Â» Istanto Blogs « Business Diary Search
- High Quality HTMl to wordpress Conversion