Worm.autoit virus(mgy.exe) make folder and all of my data files add extension .exe.exe.exe(example: desktop.ini.exe.exe.exe, mydata.xls.exe.exe, after cleaning and delete this all, my data and same file size is 16033MB, and check my files version is already change original and internet name is ''smss.exe'' how to recover my data on original.

It is not a Virus. Look at this for assistance: https://www.youtube.com/watch?v=3wFbL4GjFys

The hard drive was corrupted but the worm virus. Worms will eat data and can change the data to what it wants (to destroy anything). If you can not do an open with to open your data with the correct program.

it seems viruses on your hard drive and the extension of viruses is .scr (it hides all files). Try this tips to un hide your files, you must show the hiden files on you pc by following these steps
1.open my computer
2. click on tools
3. click on folder option
4. on the advance setting find the category of hidden files and folder
5. show choose hidden files and folder
6. click ok

the second step click run (you can find by left click start button )
type cmd
you will be in a command prompt and it will be C:\\
then type the path of your hard drive (for example F:)
after the path show your drive (for example F:) type attrib -s -h -r -a /s /d
wait until the process finish
now you can see the original file of you with extension file folder not .exe or .scr
you can delete the file with extension .exe and .scr by one left click to the file and press shift and delete button on your keyboard.
don't forget to scan your drive with anti virus

• Featured

I guess you know that computer viruses are everywhere. This guide will help you and your computer avoid being infected by viruses. There are many ways to help you prevent being infected by viruses having a good and an updated anti-virus will not always save you but it is one of the best way to prevent it.

Types of viruses

There are lots of types of viruses most of them are simply programs or scripts that will cause various problems or damage to your computer such as corrupted files, creating a copy of itself, deleting your hard rive files etc. Most of the viruses spreads itself by mailing themselves to people on your address book and some of them will try to convince you to open the attachment, But that trick never worked on me. In fact, I found myself emailing people just to make sure they really did send me something. It does not hurt to be safe.

Worms

Worms are different kind of virus but the same idea. Worms are designed to copy themselves a lot on a network and they usually eats up bandwidth by sending commands to servers to be able to get in. When the worm successfully infiltrate the system it will try and go into other servers from there. Some worms such as the SQL slammer will simply send themselves over and over so many times that they will clog up networks, and sometimes all of the internet. Worms usually affect servers more than home users, but again, this depends on what worm it is. It is suspected that most worms are efforts from the RIAA to try to stop piracy, so they try to clog up networks that could contain files. Unfortunately, the RIAA have the authority to do these damages and even if caught, nothing can be done.

Trojans

This type of virus is simply like a server that hackers use to get into the computer. An example of this is Subseven, it can enable a hacker to do various things such as control the mouse, eject the cd-rom drive, delete/download/upload files and much more.

MBR viruses

Boot Sector viruses are similar to file viruses but they go into the boot sector. These type of virus is hard to remove and can cause serious damage when the computer is booted, some of it's kind can easily erase all the data on your PC just by booting your computer.

Most viruses have different characteristics. For example, a worm can also be a trojan and also infect the boot sector. It all depends on how the virus is written and what it is designed to do. That's why there are not really strong structured categories, as they can easily mix one in the other.

Know the potentially dangerous files

Just like any other files, viruses must be opened before they can do damage. Most of them comes from e-mail attachments. Most of this type disguise as someone you know and convince you to open the attachment. My great advice: Never open attachments at any cost! Some viruses will infect files in programs, so opening a program will actually open the virus, maybe the same one, or another part of it.

All files have what is called an extension; This is the 3 last letters after the last period. For example, setup.exe has a file extension of .exe.

Extensions to watch out for are .exe .com .bat .scr .pif .vbs and others, but these are the most seen. .exe .com .bat .pif and .scr are valid extensions for executables. A virus writer will simply rename it to one of these and it will work the same way. .pif is a shortcut to an ms-dos program and will have the ms dos icon, but will still execute whatever code is in it, so an .exe can be renamed to .pif and be run the same way. .bat is a batch file, which can contain instructions to do various file activities, but again, a .exe can be renamed to .bat and it will execute it! .vbs is a visual basic script. For some reason, Microsoft provides this scripting language along with the scripting host to make it more convenient to design and write viruses quickly and easily, I've never seen another use for this scripting language other than for writing viruses. There are programs that are written with that language, but it is compiled into an exe. Exe is the usual extension for programs, you would not have a software CD install a bunch of vbs files all over!

Bottom line is, if you don't know what a file is just don't open it. Some viruses will sometimes be named a way as to mask the real file extension to make it look like a harmless file such as a image file. This is easily noticed, but can still be missed. Simply don't open unexpected files.

If you get something that appears like something legit, just ask the person it came from if they sent it. Most viruses use a friend's address to make it look like it comes from them. The virus does this by using the person's address when sending itself to the address book contacts.

Downloads

Email is not the only source of viruses you can also get viruses from P2P file sharing programs such as Kazaa, Bearshare, Limewire, direct connect etc.

Watch out for the size when you are downloading programs. When you see a program that you expect to be rather large such as game don't download it, don't get files that is 10KB it is more like to be a virus than a legit file. File size is not the only thing to watch I've been caught with a virus even with large files, as an exe is still valid even if junk is added at the end, so a 64KB virus will still function even if it is turned into 650MB.

You should look for icons, fortunately, virus writers don't take time to put icons. If you are downloading a setup file your setup file should have setup icon if it's blank that file is more or less a corrupted file or a virus.

Best advice after downloading and before opening a file is to scan it with an updated antivirus. but rely on your antivirus as we all know virus scanners are not perfect, if the virus has not been reported to them yet, they won't know to create a definition for it!

Changing settings to stay safe

If you happen to open a virus and you want to avoid the virus from infecting your friends the simplest to do is not to use the windows address book. It's very easy for viruses to get through windows address book and unfortunately Microsoft is not doing anything to fix it. Just put them in a spreadsheet or even better write them down somewhere. Don't use the address book!

Avoid using the auto preview some viruses can open themselves just by opening the mail. There are security holes in Microsoft mail programs that allow this. To disable auto preview on Microsoft outlook just click on the menu and remove auto preview. remember to do this for every folder but the inbox is most important. In Outlook Express, click on the view menu and go to layout. In the dialog box, you will see a check box for show preview pane. Uncheck it and click ok.

Removing a virus

Sometimes a clean install wont remove viruses the best way is perform a low level format. This is especially true of you got a boot sector virus, as even repartitioning and formatting won't quite remove it, but sometimes you can get away with an fdisk /mbr, but not all the time. Use good virus removal tools but then again clean install is always the best way to ensure that it's gone for good.

Viruses are out there, don't be one of the many infected ones! Stay alert and stay safe! Don't open unexpected files, regularly update your virus definitions and scan downloaded files!

This must be a worm that replicates files/folders. As we all know, desktop.ini is not a folder, it's a system file which can be opened with Notepad.

What antivirus were you using to scan your computer? This worm/s can be easily detected and deleted/repaired by avg free (click here to download avg free). [open the link and click green "Download" button]

Download and install the Avg Free. Run a full system scan and check the result. That will fix the issue related to your desktop.ini folder etc..etc..

If you need further help, let me know.

Good luck.

Thanks for using FixYa.

HOW TO REMOVE RAILA ODINGA VIRUS IN 2 MINUTES
How to remove raila odinga virus is a very easy process. Firstly, Raila odinga is a worm that attacks Microsoft word files, but it looks like a JPG file and mostly found on the desktop.
Raila odinga has some common characteristics
1. If you delete the picture file it will delete and return to where it was.
2. It runs from the driver folder in system 32 folder
3. it auto runs at system startup
4. It makes the computer boot slowly
5. It makes your computer to hang.
6. It creates new folder.exe folders in your computer
How to remove raila odinga virus, open my computer, double click drive C: open WINDOWS folder, double click on system 32 folder, open driver folder,
locate the word file in the folder, note the name. Right click on the task bar, open task manager, click on the process tab locate the name of the word file you saw in the drive folder, right click on the name of the file, click end process, to terminate the running process
Open the driver folder of system 32 where the file is, delete all the ms word files on that folder, then close the folder locate the raila odinga picture file usually on the desktop or somewhere in your computer, delete the picture file. Please do not double click on the picture file only delete it, finally empty your recycle bin and restart your computer. That way odinga is off your machine.

When the executable is run on the victim's machine, the worm copies itself to the following locations:

• %Application Data%\remove.exe (Copy of itself)
• %Application Data%\autorun.inf

Where %Application Data% = c:\Documents and Settings\All Users\Application Data
Autorun.inf has following command
Exp: [autorun]
shellExecute=remove.exe
The worm adds a Run entry in registry so that it executes itself at every startup:

• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
  "(Default)" = "%Application Data%\remove.exe"

Symptoms -

• Presence of above mentioned files.
• Presence of registry entries mentioned above.

Method of Infection Method of Infection - This worm spreads by using autorun.inf on shared drives and removable devices.
Removal - A combination of the latest DATs and the Engine will be able to detect and remove this threat. AVERT recommends users not to trust seemingly familiar or safe file icons, particularly when received via P2P clients, IRC, email or other media where users can share files.


Thanks for using fixya..

grisofts avg version 7.5.516/1227 should take care of that.. it's on their virus index for january 15th..

avg free should get rid of it..
download & run the scan.

http://free.grisoft.com/ avg is like... almost the best FREE antivirus program.

its simple guys..!!!
if it asks for permission to access outlook..don't permit it because it is a smart virus and is going to spread it to all the people on your contact list...!!!
simply open task manager and end process tree of KHATRA.exe , gHost.exe , xplorer.exe and OUTLOOK.exe seperately...!!
then run your anti virus or download one if you don't have one..!!!
run a complete computer scan in detail..!!
then delete all files which are infected by the virus because the results contain only duplicate files which are created by the virus

hi my friend got that last week to... ehat you need to do is download kaspersky. after running kaspersky. that will be gone. you can download kaspersky @ majorgeeks.com Here are some examples of autorun viruses which rely on the autorun function of Windows to infect PC’s and flash drives. Funny UST Scandal.avi.exe Autorun.vbs win32.autorun.k copy.exe imgkulot taga lipa are autorun.vbs recycler FS6519.dll.vbs strawberry from baguio W32/Perlovga (copy.exe | host.exe) VBS_RESULOWS.A Bha.dll.vbs w32automa worm (Autorun.vbs) Trojan.Win32.VB.atg | Win32/Dzan | Worm_vb.bnr (tel.xls.exe | mmc.exe) W32/RJump.worm (RavMonE) Worm.Win32.Delf.bf | W32.Fujacks (spoclsv.exe) W32.Fujacks.BH (****.vbs) WORM_AGENT.PGV (soundmix.exe) W32/Hakaglan.worm (RVHost.exe) Trojan.Win32.VB.ayo [AVP] (Macromedia_Setup.exe) Trojan.VBS.DeltreeY.b#1 (Destrukto!!! | destrukto.vbs) if you want to manually delete it... Solution is here: 1. Start Notepad [Start Menu-All Programs-Accessories-Notepad] or right-click any empty space in your desktop then select New-Text Document 2. Copy the following text. (note: Everything in between the square brackets should be in one line) REGEDIT4 [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionIniFileMappingAutorun.inf] @="@SYS:DoesNotExist" 3. Save the file with a name (anything) like DisableAutoRun.reg (The extension .reg is the important part) 4. Double Click your newly created registry file. Choose yes or continue to the warning that will appear. hope this helps