Member Avatar for questionmy

Could you please help me? There is the Trojan.FileHarakiri virus on my computer http://xmages.net/storage/10/1/0/4/3/upload/075b2803.jpg My antivirus is unable to do anything. This virus is corrupting my files and I can't open Word and Excel files, as well as my photos and e-mail. How do I delete it from my computer? Can I still save the files?!!!

  • 4 Contributors
  • 4 Replies
  • 205 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by jholland1964
Member Avatar for imagine_

hi. It's an old virus, and it usually invades your computer to make you pay money. As you pay, your credit card information is being stolen, and it is later used to steal the money from it. However, even after you pay, the virus does not get deleted from the computer. Here I have written a short instruction on how to delete it (although I still think it may not work for all the versions of the virus):

1. HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon - replace Shell via explorer.exe
2. kill alert.exe process
3. remove $APPDATA\Primary

it's far more complicated to restore the files. Not all of them can be restored. I tried programs <snip> and <snip>, but the one that works the best is <snip>. It helped me with e-mail files and photos that other programs failed to restore

Edited by crunchie because: Snipped URL's. Keep it spam free!
Member Avatar for jholland1964

The steps given above are the least of your worries. NONE of those steps will remove this infection and that is the very first order of business that must be undertaken. File recovery at this point is useless, removal is #1.
To begin this process follow the instructions in our Read Me First sticky and post back here with all the requested logs.

http://www.daniweb.com/forums/thread134865.html

Edited by jholland1964 because: n/a
Member Avatar for crunchie

I guess he is that infected he cannot get back. Too bad.

Member Avatar for jholland1964

Oh I don't think we need to worry, I believe questionmy's computer is still working well enough to post this identical question at three more forums several days after posting here along with his "imaginary friends" identical response and they also remain at seven other forums too. All but two have removed the "imaginary" or "extended" unapproved links given in the response as we have done here. So we don't need to be concerned.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.