I have this virus C:\WINDOWS\Funny ST Scanqdal.exe

How to remove the virus:
first download taskiller in here or here and install it to your computer because you can’t use task manager to terminate the virus(the virus automatically close task manager).

run taskiller and left click it on the system tray(the one with a skull icon)
click processes
to close the virus, select process and click yes to the question
(process to close)

1. killer.exe
2. lsass.exe
3. smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe
CMD STEPS

1. now, click “start” then “run”
2. type “cmd” without quotes
3. type “cd\” without quotes
4. type “attrib -h -s smss.exe” without quotes
5. type “attrib -h -s autorun.inf” without quotes
6. type “start c:” without quotes (a new window will open)
7. select smss.exe, autorun.inf, Funny UST Scandal.avi.exe and delete it

If theres any drive or a partition type “d:” in command prompt without quotes “d” is the drive letter then repeat the CMD STEPS number 4-7 above…….

• now type this on the command prompt “cd windows” without quotes.
• type “attrib -h -s smss.exe” (without quotes)
• type “start c:\windows” (without quotes)
• delete the file smss.exe
• now, goto c:\documents and settings\all users\startmenu\programs\startup
• delete lsass.exe

click “start” then “run”
type “regedit” without quotes then delete the registry entries above….
“VIRUS REMOVE”
Or just simply download this UST VIRUS REMOVER (not tested)

Funny UST Virus Activities:
First of all this virus is not funny at all, either it may put yourself in state of embarrassment when it sends some senseless message to your friends in your yahoo messenger buddies.
It creates following files:

• Killer.exe in c:\windows\
• lsass.exe in c:\documents and settings\all users\start menu\programs\startup
• xmss.exe in the root drive of all partitions and also in c:\windows
• autorun.inf in all the partitions.
• the main file Funny UST Scandal.avi.exe in all the partitions and
• Funny UST Scandal.exe in c:\Windows.

Not only this, it also creates the following entries:
HKLM\Software\Microsoft\WindowNT\CurrentVersion\Winlogon\shell HKCU\Software\Microsoft\windows\Currentversion\Run\Runonce

You will find all these or some of these files if your system is infected by this virus.

How to remove this virus:

-first download taskiller in http://www.rsdsoft.com/task_killer
and install it to your computer because you cant use taskmanager to terminate the virus(the virus automatically close taskmanager).

-run taskiller and left click it on the system tray(the one with a skull icon)

-click processes

-to close the virus, select process and click yes to the question

(process to close)
1.killer.exe
2.lsass.exe
3.smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe


CMD STEPS
1-now, click "start" then "run"
2-type "cmd" without quotes
3-type "cd\" without quotes
4-type "attrib -h -s smss.exe" without quotes
5-type "attrib -h -s autorun.inf" without quotes
6-type "start c:" without quotes(a new window will open)
7-select smss.exe,autorun.inf,Funny UST Scandal.avi.exe and delete it

-if theres any drive or a partition type "d:" in command prompt without quotes
"d" is the drive letter then repeat the CMD STEPS number 4-7 above.......

-now type this on the command prompt "cd windows" without quotes(na naman!)
-type "attrib -h -s smss.exe" without quotes(uli)
-type "start c:\windows" without quotes(hay naku!)
-delete the file smss.exe
-now, goto c:\documents and settings\all users\startmenu\programs\startup
-delete lsass.exe

-click "start" then "run"
-type "regedit" without quotes then delete the registry entries above....

Hope this helps!

Brad Nelson

download "protector pro" this software erase all internet history etc etc. i already tried

" After receiving many complaints from people’s about this virus, I finally decided to guide the users about the removal of this virus. Some of the problems caused by this virus are :
1. Show Hidden Files and Folders not working.
2. My Computer Drives open another explorer window.
3. When you run a program, just in 2 or 3 minutes the program dissappears (Actually runs in background but you can not see its window in foreground).
Removal of this Virus
Unfortunately, I have no removal tool to remove this virus at the time of writing, but you will soon see one. You can try the manual removal of it.
Manual Removal
Caution : While the manual process is going on, do not open any My Computer drive.
1. Open up cmd by typing cmd in Start –> Run.
2. Type in cmd
taskkill /f /im smss.exe
taskkill /f /im killer.exe
3. The virus placed some files at the root of every drive so you need to clean them.
Repeat the following commands on cmd for all your drives (Here it is applied for C drive)
del /a:h /f c:\autorun.inf
del /a:h /f c:\smss.exe
del /a:h /f c:\funny ust scandal.avi.exe
4. Now you need to delete files in windows folder so type :
del /a:h /f c:\windows\killer.exe
del /a:h /f c:\windows\autorun.inf
del /a:h /f c:\windows\smss.exe
del /a:h /f c:\windows\funny ust scandal.exe
5. Now you need to delete one more file :
del /a:h /f “%userprofile%\Start Menu\Programs\Startup\lsass.exe”
6. Use PowerExes to delete startup entries like.
smss.exe
lsass.exe(if it does not remove then only uncheck it)
killer.exe
7. To restore Folder Option Settings Follow this page
Show Hidden Files And Folders Not Working
8. To Remove the virus from Flash Drive, Insert a flash drive cancel any Autoplay box.
Open cmd and type (Replace x by your usb drive letter)
del /a:h /f x:\autorun.inf
del /a:h /f x:\smss.exe
del /a:h /f x:\funny ust scandal.avi.exe"



(source of info can be found here)

first download taskiller in http://www.rsdsoft.com/task_killer/index.php4
and install it to
your computer because you cant use taskmanager to terminate the virus(the
virus automatically close taskmanager).

-run taskiller and left click it on the system tray(the one with a skull icon)

-click processes

-to close the virus, select process and click yes to the question

(process to close)
1.killer.exe
2.lsass.exe
3.smss.exe

note: close only file that have the same icon of Funny UST Scandal.avi.exe


CMD STEPS
1-now, click "start" then "run"
2-type "cmd" without quotes
3-type "cd\" without quotes
4-type "attrib -h -s smss.exe" without quotes
5-type "attrib -h -s autorun.inf" without quotes
6-type "start c:" without quotes(a new window will open)
7-select smss.exe,autorun.inf,Funny UST Scandal.avi.exe and delete it

-if theres any drive or a partition type "d:" in command prompt without quotes
"d" is the drive letter then repeat the CMD STEPS number 4-7 above.......

-now type this on the command prompt "cd windows" without quotes(na naman!)
-type "attrib -h -s smss.exe" without quotes(uli)
-type "start c:\windows" without quotes(hay naku!)
-delete the file smss.exe
-now, goto c:\documents and settings\all users\startmenu\programs\startup
-delete lsass.exe

-click "start" then "run"
-type "regedit" without quotes then delete the registry entries above....

Note:
If you have problems opening drives in My Computer open regedit find
"\smss.exe" then erase values like: "c:\smss.exe", "d:\smss.exe" etc..


Hope this helps

Funny UST scandal virus Disinfection.. Virus Disinfection Using McAfee Antivirus

1. To disinfect the virus please download the latest sdat????.exe from this site and save it C:\TEMP

2. Now restart the System and press F8 key
3. Select Safe mode with Command Prompt
4. Then change directory to C:\TEMP
5. There type the filename and give the parameters as follows:

C:\TEMP>sdat5185.exe /e

After few seconds in that directory you will find some files that extracted from the dat file.

6. Give commands as follows:

C:\Temp>SCAN /all /adl /clean /report Report.log

This will clean all the virus in the system.

Hope this will helps you..

If this works please comment me.....

Nandu :)

I done research on this but not tested to my computer ..just try this remover created in philippines . this the link: http://www.geocities.com/six519/Remover.zip may this help.

Hello ppl,


Simply install PCTOOLS ANTI-VIRUS to Scan , Remove and then filter your internet for such threats... It's FREE... includes free updates too....



Easy.. XD