Remove virus AMBURADUL (all varian)

They never been stop spreading their knowledge…. and we also never let them alive forever. This is the article how to remove amburadul virus for all varian no need for antivirus program you can simply clean it using manual technique.

The simple way to know if your computer infected by this virus is you will see JPEG files with aplication extension. Now let’s start to remove it!

1. Unplug your infected computer from your network to stop this virus spreading.
2. Disable “System Restore” when in cleaning process.
3. Kill the virus process using power tools “currprocess” kill all process with icon JPG.
4. Repair your registry that already changed by the virus using this code:

[Version]
Signature=”$Chicago$”
Provider=Nobody

[DefaultInstall]
AddReg=UnhookRegKey
DelReg=del

[UnhookRegKey]
HKLM, Software\CLASSES\batfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”””%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0x00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,CheckedValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,DefaultValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, CheckedValue,0x00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, DefaultValue,0x00010001,0
HKCU, Software\Microsoft\Internet Explorer\Main, Start Page,0, “about:blank”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, type,0, “checkbox”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, type,0, “checkbox”
HKCU, Control Panel\International, s1159,0, “AM”
HKCU, Control Panel\International, s2359,0, “PM”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0x00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0x00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0x00010001,0

[del]
HKCU, Software\Microsoft\Internet Explorer\Main, Window Title,
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableConfig
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableSR
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-CLN.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-RTP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe, debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, DisableMSI
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, LimitSystemRestoreCheckpointing
HKCR, exefile, NeverShowExt
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, PaRaY_VM
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, ConfigVir
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NviDiaGT
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NarmonVirusAnti
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AVManager
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, EnableLUA

5. Delete the master virus in %systemroot%\system32\~A~m~B~u~R~a~D~u~L~ before you do this you have to make hiden files become visible.
Then deleted this file list:

csrcc.exe
smss.exe
lsass.exe
services.exe
winlogon.exe
Paraysutki_VM_Community.sys
msvbvm60.dll
Drive:\Autorun.inf
Drive:\FoToKu xx-x-*.exe, where x show the date when virus active
Drive:\Friendster Community.exe
Drive:\J3MbataN K4HaYan.exe
Drive:\MyImages.exe
Drive:\PaLMa.exe
Drive:\Images

To make sure your computer clean you can check scan your computer using your favorite antivirus programs.
Done, have a nice day 😀

40 thoughts on “Remove virus AMBURADUL (all varian)”

sari July 21, 2008 at 2:14 PM

Thanks for this article, my computer got infected by this virus but I already cleaned it using this tips.
bahar July 22, 2008 at 5:18 AM

My cybercafe is also subject to these viruses could eventually eradicated also hehe, nice to meet you.
juned July 24, 2008 at 3:11 AM

I just know there is new virus…
harianku July 24, 2008 at 3:12 AM

thanks for the tips .., I will try first .. 😛
Istanto July 24, 2008 at 5:30 AM

This virus not only internet cafe just happened yesterday I got finished I write here how to tackle the virus it: D
Busby SEO Challenge August 11, 2008 at 4:27 AM

Hi nice work! Good luck.
eko hadi sulistyo August 19, 2008 at 9:16 PM

I’ve tried to do all the instructions above to remove the virus in shambles, but when I restart my laptop, the virus appeared again, even that all my antivirus installed and up to date, lost all. How do I deal with it, please …., I wait an answer as soon as possible.

Regards Eko
Istanto August 20, 2008 at 2:03 PM

the possibility eko Alman contaminated with the virus that attacks files with ektension .exe try to download norman antivirus or antivirus that can detect this virus and then scan Alman total laptop flash disk (if using) just started the cleaning process. just a suggestion, I cleaned the virus in shambles yesterday was just using the tools of ANSAV without significant problems.

good luck:)
Eko Hadi S August 22, 2008 at 2:19 AM

Thank for answer, I do use AVG 8, PCMAV 1.6, and the actual ANSAV happens all good clean virus on drive C, D and Flash disk, the virus was also detected Alman. But I was surprised when I restart, all my anti-virus and install missing file structure on my laptop back as when I turn on earlier. (use anti-virus norman I have not tried)
simply this: I do like the above instructions, can be installed anti-virus scan to clean my files in my document or delete some files / folders I delete. but after I restart, all returned. so as if the arrangement of files and the viruses still appear as before after the restart. I arrived …., stressful if you address some surabaya I’ll come for help. For a friend or anyone who can advise him I wait for an answer. (Just do not re-used in the install). Thanks severe
Istanto August 22, 2008 at 2:33 PM

DH eko, apparently because the virus was re-master is still there or he still has executes autorun file so every computer restart the virus again re-establish its structure, especially if contaminated with other viruses it should be thoroughly cleaned. try to note the windows startup or service usually try to cover herself virus2 on that part … oh yes my advice should be cleaned before it Alman virus when it convinced a new clean Alman began cleaning his shambles virus

to note possible:
1. system restore service for cleaning help in non-switch.
2. make sure the computer is not installed deepfreeze program or imaging such as that every restart will return to the initial conditions.
3. check windows service startup or start any active windows.
4. note and delete the file autorun.inf which usually make the main weapon as a generator of the virus in Indonesia are mostly from the root drive using eg in c: \ d: \ and that is the case most of the flash.
5. Do not use the flash while the time to make sure where to start when the computer virus is a source of clean and infected in the flash again enter the main problem is obvious from the flash.
6. if possible during the cleaning process should not open another application that is not important.

If not successful eco also be able to contact a computer expert around surabaya I can not help because I am located in the malang … 🙂
Eko Hadi S August 23, 2008 at 1:50 AM

Thanks a heavy, my laptop there deepfreeze. Later I will try your instructions above, if you must know the address where Malang, please sms only at 0358-7648650. If I’ve tried the suggestions of you still not able to, I want to ask for help to come to the place you all acquaintances. My position on Nganjuk so away from Surabaya or Malang almost the same. One more information I provide, my laptop as if it only works in memory, so when I save files, delete files or folders, install programs, etc., after the restart will return to the original structure. You for your attention I have to say many thanks.
Istanto August 26, 2008 at 4:40 PM

deepfreeze his first shutdown mode in THAWED new virus is first cleaned first and then Alman in shambles, when it’s finished restart your computer in convincing the new virus is gone again deepfreeze at the switch. simple problem’s all because there deepfreeze behind it, although the cleaning of millions of times if the process is still active deepfreeze’ll never be clean.

OK so it was not necessary Kemalang make it clear that he he would be acquaintances 😀
danang September 8, 2008 at 12:43 AM

to enable regedit? currproses can not run

information please
Istanto September 9, 2008 at 10:51 PM

to enable regedit crude way (not recommended, use at your own risk) can use the following ways:

Start> Run> cmd> type:
reg delete HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System

confirmation Yes

If the command prompt on the block also can use an alternative way, save the code below to any names, but use the extension. Reg then double click.

REGEDIT4

[HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System] “DisableRegistryTools” = dword: 00000000
Edu October 6, 2008 at 5:25 AM

Istanto a kind … I have a problem about the virus mainly Amburadul.B Amburadul …
I’ve tried all the way over …
But there is a problem I encounter ..
I’ve run a virus deadly cproses then they will be, then why:
1. regedit, cmd same maxi administrator disabled (because the virus is not it?) Then I have to do?
2. I’ve tried using the save way use format. Reg, but still registry di’disable’kan by viruses .. Administrators do have control panel on the block too …
Please Enlightenment …..
I am waiting a reply …
istanto October 6, 2008 at 10:15 AM

Edu cpc DH,
Varian amburadul.A or amburadul.B actually not much different .. everything can be solved with a way above the origin followed by good will.

1. To fix the problem in the registry that the virus just use the fox above code in the save as repair.inf or whatever name it is important extension. Inf right click and click install if you have not tried the restart function computer.

2. if registry is still disable the command prompt and disable also still possible cpc Edu could make a batch file with the extension. bat with a line to delete some parts of the registry in the way, how easy enough to search on google would have home care.

If you still can not I can fix FREE but maybe the father should have a brother in the poor could easily dicontact order. Please note also for the startup and services may be less rigorous father.

Regards,
Istanto
Edu October 9, 2008 at 9:11 AM

Well … Thanks a lot … Oh yes, I’m not fathers yet, i’m still 17 years old … Hahaha …;-)
Thx a lot …
thank for this good …
Success is always …
rido October 13, 2008 at 12:55 AM

ask for help …!
its my computer explorer can not open, can only enter the program through task manager (run), cmd + msconfig can not.
Why??
thanks
Istanto October 14, 2008 at 3:49 AM

Clearly, the registry is damaged by a virus, just short of his registry in shambles, it happened after trying to clean the virus in shambles? if yes did I ever have 1 case after trying to clean a laptop from a friend in shambles virus exactly the case with you, the explorer does not autoload when windows start and do not associate files bener … I try to fix first. inf registry + associates Registry (search on google there) my new code import the above, the laptop back to normal even faster 😀
… first tried many paths to roma ..
zamhuri December 22, 2008 at 12:52 PM

greetings to all,

I want to ask the moderator, all the administrative tools can not be running, there is missing text switches / s my computer was infected by shambles, what’s the solution?

THz b4
Bagus December 30, 2008 at 11:31 PM

thank you for the information
Ok juga February 8, 2009 at 9:03 AM

Ok this is a virus. although I also hit. so we fight to ask questions and learn to find a cure. may also make up some anti-virus prevention and let them be creative … as this virus for people who love pictures like that. if in his view of the image. eat that picture might he said. ok just for that once again congratulations for creating. survivors can also create a window format could’ve ha ha …. how Joking.
Oya om February 8, 2009 at 9:17 AM

Oh yes so I format it. after completion can not shut down the lights on still dim. monitor is also dim. What the shambles or from another reply. so the second format OK
tom February 25, 2009 at 8:56 AM

I got it but explorer still open when the file association is justified ????????????? just seen the box it out the windows explorer start up
Istanto February 26, 2009 at 1:36 AM

Mmmhh .. try in check at startup in msconfig in the registry
fadly March 14, 2009 at 9:31 PM

ouch ……. how this boss??
restore the system application and others can not open??
Istanto March 15, 2009 at 6:47 AM

@fadly = because of it?
hangga June 5, 2009 at 7:19 AM

How to remove a virus w32.hakagan?
Thanks
Irvan June 7, 2009 at 12:16 AM

This is the information that I really need. Thanks so much!
Pradiksa July 30, 2009 at 8:09 PM

I got Sality.AQ W32,,,
if I make norman clean,. exe file to be corrupted ….
there are suggestions that powerful anti-malware can be cleaned without damaging this .exe files?
Istanto July 31, 2009 at 2:13 AM

first time I had it all clean. exe file corrupted (not know if I can at repair) and I throw on the new content. try searching on the repair. exe I’ll help you find ….
ogaldanio August 6, 2009 at 12:38 PM

I want to ask, my laptop got a virus, the virus I do not know what, because if the I restart or shutdown laptop not boting or response bios, usually in the press repeated it again a new power to live, ok thanks ….. …….
Istanto August 6, 2009 at 2:51 PM

@ pradiksa: I’ve been asked directly to enginer norman, norman mallware you download the latest cleaner can fix. exe is the damaged sality

@ ogaldino: Could be a virus but it was not you who is corrupt OS / computer hardware you are in trouble, because I’ve been able to shutdown Patcher problems in 98 cases of the same windows server 2003. You wear what windows OS? try to check on his website about the shutdown microsoft Patcher. If you’ve installed the patch still does not mean that the virus may try to check the condition …
Finna August 10, 2009 at 3:38 AM

Thank you… although not yet .. hopefully try not to ..
laptop + external hard disk virus taxable limit.exe
indication of any online 1-7 hours of direct morning outside the limit of 15 minutes and then shutdown …
can you help me?
Thank you …
Istanto August 10, 2009 at 6:02 AM

I’ll write a complete removal of viruses when I have time limit.exe references in:

http://forums.techguy.org/malware-removal-hijackthis-logs/653928-limit-exe-shutdown-15-minutes.html
csdw October 10, 2010 at 8:37 AM

i like yhis solution
Jamal December 28, 2010 at 3:44 AM

how do when a virus is installed and registry system block 32 ?
Istanto December 31, 2010 at 6:43 PM

get some tools to unlocked your registry.
ibenk August 16, 2012 at 5:09 PM

my labtop problm in hard disk, when i on laptop always data lost.
i tray install my labtop but can’t do it because same hard disk coropted or protected. & my hard disk 320gb but in install only 305gb
domain September 9, 2014 at 5:11 AM

An intriguing discussion is definitely worth comment.
I think that you should publish more on this issue, it may not be a
taboo matter but typically people don’t speak about these issues.
To the next! Kind regards!!

Remove virus AMBURADUL (all varian)

Similar Posts:

RELATED SEARCH TERMS:

40 thoughts on “Remove virus AMBURADUL (all varian)”

Leave a Reply Cancel reply