Remove virus AMBURADUL (all varian)

They never been stop spreading their knowledge…. and we also never let them alive forever. This is the article how to remove amburadul virus for all varian no need for antivirus program you can simply clean it using manual technique.

The simple way to know if your computer infected by this virus is you will see JPEG files with aplication extension. Now let’s start to remove it!

1. Unplug your infected computer from your network to stop this virus spreading.
2. DisableSystem Restore” when in cleaning process.
3. Kill the virus process using power tools “currprocess” kill all process with icon JPG.
4. Repair your registry that already changed by the virus using this code:



HKLM, Software\CLASSES\batfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\comfile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\exefile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\piffile\shell\open\command,,,”””%1″” %*”
HKLM, Software\CLASSES\regfile\shell\open\command,,,”regedit.exe “%1″”
HKLM, Software\CLASSES\scrfile\shell\open\command,,,”””%1″” %*”
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, Shell,0, “Explorer.exe”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, UncheckedValue,0x00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,CheckedValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt,DefaultValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, UncheckedValue,0x00010001,1
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, CheckedValue,0x00010001,0
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, DefaultValue,0x00010001,0
HKCU, Software\Microsoft\Internet Explorer\Main, Start Page,0, “about:blank”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt, type,0, “checkbox”
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden, type,0, “checkbox”
HKCU, Control Panel\International, s1159,0, “AM”
HKCU, Control Panel\International, s2359,0, “PM”
HKLM, SYSTEM\ControlSet001\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKLM, SYSTEM\CurrentControlSet\Control\SafeBoot, AlternateShell,0, “cmd.exe”
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, ShowSuperHidden,0x00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, SuperHidden,0x00010001,1
HKCU, Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, HideFileExt,0x00010001,0

HKCU, Software\Microsoft\Internet Explorer\Main, Window Title,
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableConfig
HKLM, SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore, DisableSR
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspoold.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kspool.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HokageFile.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rin.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Obito.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SMP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KakashiHatake.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-CLN.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears-RTP.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\boot.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HOKAGE4.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Britney Spears
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansav.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Instal.exe, debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Install.exe,debugger
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msiexec.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe
HKLM, SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ansavgd.exe
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegistryTools
HKCU, Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, NoFind
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, DisableMSI
HKLM, SOFTWARE\Policies\Microsoft\Windows\Installer, LimitSystemRestoreCheckpointing
HKCR, exefile, NeverShowExt
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, PaRaY_VM
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, ConfigVir
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NviDiaGT
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, NarmonVirusAnti
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Run, AVManager
HKLM, SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, EnableLUA

5. Delete the master virus in %systemroot%\system32\~A~m~B~u~R~a~D~u~L~ before you do this you have to make hiden files become visible.
Then deleted this file list:

Drive:\FoToKu xx-x-*.exe, where x show the date when virus active
Drive:\Friendster Community.exe
Drive:\J3MbataN K4HaYan.exe

To make sure your computer clean you can check scan your computer using your favorite antivirus programs.
Done, have a nice day 😀

Similar Posts:


40 thoughts on “Remove virus AMBURADUL (all varian)”

  1. Thanks for this article, my computer got infected by this virus but I already cleaned it using this tips.

  2. My cybercafe is also subject to these viruses could eventually eradicated also hehe, nice to meet you.

  3. I’ve tried to do all the instructions above to remove the virus in shambles, but when I restart my laptop, the virus appeared again, even that all my antivirus installed and up to date, lost all. How do I deal with it, please …., I wait an answer as soon as possible.

    Regards Eko

  4. the possibility eko Alman contaminated with the virus that attacks files with ektension .exe try to download norman antivirus or antivirus that can detect this virus and then scan Alman total laptop flash disk (if using) just started the cleaning process. just a suggestion, I cleaned the virus in shambles yesterday was just using the tools of ANSAV without significant problems.

    good luck:)

  5. Thank for answer, I do use AVG 8, PCMAV 1.6, and the actual ANSAV happens all good clean virus on drive C, D and Flash disk, the virus was also detected Alman. But I was surprised when I restart, all my anti-virus and install missing file structure on my laptop back as when I turn on earlier. (use anti-virus norman I have not tried)
    simply this: I do like the above instructions, can be installed anti-virus scan to clean my files in my document or delete some files / folders I delete. but after I restart, all returned. so as if the arrangement of files and the viruses still appear as before after the restart. I arrived …., stressful if you address some surabaya I’ll come for help. For a friend or anyone who can advise him I wait for an answer. (Just do not re-used in the install). Thanks severe

  6. DH eko, apparently because the virus was re-master is still there or he still has executes autorun file so every computer restart the virus again re-establish its structure, especially if contaminated with other viruses it should be thoroughly cleaned. try to note the windows startup or service usually try to cover herself virus2 on that part … oh yes my advice should be cleaned before it Alman virus when it convinced a new clean Alman began cleaning his shambles virus

    to note possible:
    1. system restore service for cleaning help in non-switch.
    2. make sure the computer is not installed deepfreeze program or imaging such as that every restart will return to the initial conditions.
    3. check windows service startup or start any active windows.
    4. note and delete the file autorun.inf which usually make the main weapon as a generator of the virus in Indonesia are mostly from the root drive using eg in c: \ d: \ and that is the case most of the flash.
    5. Do not use the flash while the time to make sure where to start when the computer virus is a source of clean and infected in the flash again enter the main problem is obvious from the flash.
    6. if possible during the cleaning process should not open another application that is not important.

    If not successful eco also be able to contact a computer expert around surabaya I can not help because I am located in the malang … 🙂

  7. Thanks a heavy, my laptop there deepfreeze. Later I will try your instructions above, if you must know the address where Malang, please sms only at 0358-7648650. If I’ve tried the suggestions of you still not able to, I want to ask for help to come to the place you all acquaintances. My position on Nganjuk so away from Surabaya or Malang almost the same. One more information I provide, my laptop as if it only works in memory, so when I save files, delete files or folders, install programs, etc., after the restart will return to the original structure. You for your attention I have to say many thanks.

  8. deepfreeze his first shutdown mode in THAWED new virus is first cleaned first and then Alman in shambles, when it’s finished restart your computer in convincing the new virus is gone again deepfreeze at the switch. simple problem’s all because there deepfreeze behind it, although the cleaning of millions of times if the process is still active deepfreeze’ll never be clean.

    OK so it was not necessary Kemalang make it clear that he he would be acquaintances 😀

  9. to enable regedit crude way (not recommended, use at your own risk) can use the following ways:

    Start> Run> cmd> type:
    reg delete HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System

    confirmation Yes

    If the command prompt on the block also can use an alternative way, save the code below to any names, but use the extension. Reg then double click.


    [HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Policies \ System] “DisableRegistryTools” = dword: 00000000

  10. Istanto a kind … I have a problem about the virus mainly Amburadul.B Amburadul …
    I’ve tried all the way over …
    But there is a problem I encounter ..
    I’ve run a virus deadly cproses then they will be, then why:
    1. regedit, cmd same maxi administrator disabled (because the virus is not it?) Then I have to do?
    2. I’ve tried using the save way use format. Reg, but still registry di’disable’kan by viruses .. Administrators do have control panel on the block too …
    Please Enlightenment …..
    I am waiting a reply …

  11. Edu cpc DH,
    Varian amburadul.A or amburadul.B actually not much different .. everything can be solved with a way above the origin followed by good will.

    1. To fix the problem in the registry that the virus just use the fox above code in the save as repair.inf or whatever name it is important extension. Inf right click and click install if you have not tried the restart function computer.

    2. if registry is still disable the command prompt and disable also still possible cpc Edu could make a batch file with the extension. bat with a line to delete some parts of the registry in the way, how easy enough to search on google would have home care.

    If you still can not I can fix FREE but maybe the father should have a brother in the poor could easily dicontact order. Please note also for the startup and services may be less rigorous father.


  12. Well … Thanks a lot … Oh yes, I’m not fathers yet, i’m still 17 years old … Hahaha …;-)
    Thx a lot …
    thank for this good …
    Success is always …

  13. ask for help …!
    its my computer explorer can not open, can only enter the program through task manager (run), cmd + msconfig can not.

  14. Clearly, the registry is damaged by a virus, just short of his registry in shambles, it happened after trying to clean the virus in shambles? if yes did I ever have 1 case after trying to clean a laptop from a friend in shambles virus exactly the case with you, the explorer does not autoload when windows start and do not associate files bener … I try to fix first. inf registry + associates Registry (search on google there) my new code import the above, the laptop back to normal even faster 😀
    … first tried many paths to roma ..

  15. greetings to all,

    I want to ask the moderator, all the administrative tools can not be running, there is missing text switches / s my computer was infected by shambles, what’s the solution?

    THz b4

  16. Ok this is a virus. although I also hit. so we fight to ask questions and learn to find a cure. may also make up some anti-virus prevention and let them be creative … as this virus for people who love pictures like that. if in his view of the image. eat that picture might he said. ok just for that once again congratulations for creating. survivors can also create a window format could’ve ha ha …. how Joking.

  17. Oh yes so I format it. after completion can not shut down the lights on still dim. monitor is also dim. What the shambles or from another reply. so the second format OK

  18. I got it but explorer still open when the file association is justified ????????????? just seen the box it out the windows explorer start up

  19. I got Sality.AQ W32,,,
    if I make norman clean,. exe file to be corrupted ….
    there are suggestions that powerful anti-malware can be cleaned without damaging this .exe files?

  20. first time I had it all clean. exe file corrupted (not know if I can at repair) and I throw on the new content. try searching on the repair. exe I’ll help you find ….

  21. I want to ask, my laptop got a virus, the virus I do not know what, because if the I restart or shutdown laptop not boting or response bios, usually in the press repeated it again a new power to live, ok thanks ….. …….

  22. @ pradiksa: I’ve been asked directly to enginer norman, norman mallware you download the latest cleaner can fix. exe is the damaged sality

    @ ogaldino: Could be a virus but it was not you who is corrupt OS / computer hardware you are in trouble, because I’ve been able to shutdown Patcher problems in 98 cases of the same windows server 2003. You wear what windows OS? try to check on his website about the shutdown microsoft Patcher. If you’ve installed the patch still does not mean that the virus may try to check the condition …

  23. Thank you… although not yet .. hopefully try not to ..
    laptop + external hard disk virus taxable limit.exe
    indication of any online 1-7 hours of direct morning outside the limit of 15 minutes and then shutdown …
    can you help me?
    Thank you …

  24. my labtop problm in hard disk, when i on laptop always data lost.
    i tray install my labtop but can’t do it because same hard disk coropted or protected. & my hard disk 320gb but in install only 305gb

  25. An intriguing discussion is definitely worth comment.
    I think that you should publish more on this issue, it may not be a
    taboo matter but typically people don’t speak about these issues.
    To the next! Kind regards!!

Leave a Reply

Your email address will not be published. Required fields are marked *

Time limit is exhausted. Please reload CAPTCHA.