The Construct

I really appreciate Leerz’s work on the Noob.Killer tool (which has evolved from simply getting rid of the Taga Lipa Are virus to covering threats such as Baguio Strawberry). And I also appreciate him using my site for updates and announcements even if my site isn’t really a tech site.

Anyway, here’s another update to that famed tool of his. Aside from a few UI tweaks and added features, it now covers the following threats:

• Taga Lipa Are/Hacked By Godzilla (and it’s other Variants)
• Baguio Strawberry Worm
• Yahoo! Worm (Sohanad)
• Krag.exe (I’m Not The Only One)
• Destrukto
• w32dranyam
• Funny UST Scandal(Avi).exe
• SilentSoftech
• Knight
• VBS Capiz
• Thank You!! WinZip123
• iloveher.exe
• display monitor.exe
• ImgKulot (and it’s other variants)

Take note that some of these buggers haven’t been really addressed by bigwig security software companies like Norton, McAffee, and even the free AVG. So kudos and many thanks to Leerz for building something great and free for us Pinoys! Download and release details can be found on Leerz’s site.

I’ve seen some computers affected by this “virus” and sadly, I think it’s not detected by Norton or AVG.

Here’s a guide on how to remove it. Kudos to SHENGTON of the PCX Forums.

1. Run Task Manager
Windows XP(Press Ctrl+Shift+Esc)
or CTRL + ALT + DEL then look for the “processes” tab, hanapin nyo un process na may name na “Wscript” end process nyo LAHAT.
2. On windows Explorer
Select TOOLS -> Folder Options tapos sa VIEW tab under “hidden files and folders” select nyo show hidden files and folders
next, uncheck hide protected operating system files
3. Browse nyo lahat nang disk drives or flashdrives nyo
( wag double click kasi magrun ulit un “wscript”) look for
“autorun.inf” and “FS6519.dll.vbs”
tapos delete nyo un 2 files, select nyo both files and press shift+delete be sure na lahat ng wscript sa task manager nka-end task.
4. Lastly, (sa wakas huling step)click start and select run, type nyo “regedit” press ctrl+F search nyo un “taga lipa are” i think 3 beses nyo sya makita, duouble click nyo un then replace it
with “Microsoft Internet Explorer” (pwede rin name nyo.. hehe..) 3 un mapapalitan nyo jan.. then exit nyo na..thats it!! restart ur PC and then OK na ulit..

Great tip, I just hate his use of “un.” “Un” is “hun” without the “H” (Kapapangan? :p) “Jan” is the abbreviation of “January.”