Saturday, 2018/02/24, 2:46 AM


Main
Registration
Login
Hackersoft Welcome Guest | RSS  
Site menu

Our poll
Rate my site
Total of answers: 11042

Statistics

Total online: 1
Guests: 1
Users: 0

MicrosoftPowerPoint.exe

MicrosoftPowerPoint.exe is a worm that spreads throught the USB Memory Sticks/Pen Drives from computer to computer. It slows down all usb operations.

Manual Removal

Since the virus automatically hides all the files, you cant easily find it.
First run msconfig, and look at the start up values to find the location of the virus.
Remove that entry by unchecking the tick mark.
Reboot the system.
Do the steps given below in the registry to unhide hidden files.

Go to run and type regedit

Your system registry will get open

gradually browse through the below areas and change the values

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer searchidden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer searchsystemdirs en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced hidden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced showsuperhiden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced superhiden en 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN CheckedValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN DefaultValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL DefaultValue 1

Find the location where it resides, from msconfig and delete the contents of the folder. Usually in /Documents and Settings/User/Local Settings/Temp/.

Now the system must be free of the virus.
Disable the autorun
to prevent further infections.

To prevent infections again to the usb, delete the contents of MicrosoftPowerPoint.exe and place a 0byte file with the same name.

Thats all
:)


Sign in

Calendar
«  February 2018  »
SuMoTuWeThFrSa
    123
45678910
11121314151617
18192021222324
25262728

IP

Copyright Hackerssoft © 2018