About cli5yr8.dll, w1hva13.exe, kxvo.exe, fool0.dll, eso0.dll, malware, trojan
Mood:
on fire
Topic: VIRUS
Another Windows XP Virus.
I have encountered a virus last night. My Antivirus kept on detecting cli5yr8.dll, for which I would select "delete virus." Problem is, cli5yr8.dll would still be detected by my computer upon restarting. So I tried removing it manually - which was also not successful.
I have noticed that this virus disables the "show hidden files and folders" so you cannot delete this file under window mode. This virus falls under the category of malware and trojan according to my AV, and it comes with the following file names:
- cli5yr8.dll - this is the virus detected by most AV and it resides in the drive where you installed windows. c:\documents and settings\"name of user"\local settings\temp. The local settings folder and temp may be hidden.
- w1hva13.exe - found in the main directory of every hard disk drive of your PC. Example: If you have three partitions in your drive like C:, D:, & E:, the w1hva13.exe probably resides in all these drives with the file hidden.
- kxvo.exe - found in "windows\system32\ " this file may be hidden.
- fool0.dll - found in "windows\system32\
- eso0.dll - found in "windows\system32\
- autorun.inf - found in the main directory of every HDD drive. This file is hidden.
All these files should be removed in your system.
How do you remove cli5yr8.dll, w1hva13.exe?
If your computer is infected with this virus and your AV cannot disinfect affected files or delete them, and when your web search on this virus turns up just an anti virus software for sale - hold your money. You need not buy an anit-virus software each time a new virus comes up because no one AV can clean them all. So, you may want to do it my way. Here are the steps to remove the virus manually in Windows XP.
Restart your computer in SAFE MODE (press the F8 key several times before your system loads and select SAFE MODE).
Since you can't see these files because they are hidden, open DOS prompt (start --> All Programs --> accessories --> command prompt).
Type cd\ at the command prompt then press Enter to go to the main directory. You should see "C:\>" if drive C is your system drive.
To verify if the files are present, at the C:\> type dir /ah to view hidden files. If you see w1hva13.exe and autorun.inf.... your computer is already infected.
At the command prompt C:\> type attrib -s -h -r -a w1hva13.exe and press Enter. This makes the file visible and removing other attributes that prevents you from deleting the file.
At the command prompt C:\> type del w1hva13.exe and press Enter.
At the command prompt C:\> type attrib -s -h -r -a autorun.inf and press Enter
At the command prompt C:\> type del autorun.inf and press Enter
Do steps 5 to 8 for all the physical drives present.
Now go back to your system drive and type C:\>dir c:\ w1hva13.exe /s /ah if you find the file, follow the searched path and do steps 5 & 6.
Go back again to the main directory of your system drive by typing cd\ and do step 10 for the other remaining files of the virus. If you cannot see these files using step 10 then probably it's not hidden, so negate the "/ah". The other remaining files kxvo.exe, fool0.dll & eso0.dll are found in windows\system32\
Lastly do step 10 or 11 for the file cli5yr8.dll.
For the registry entries of this virus. I never looked for it. My computer is working just fine. Use the system restore to rewind your system registry.
TIPS:
1. Learn how to use the command prompt or DOS mode.
2. Normally autorun.inf should not be present in your hard disk drives. This is commonly present in cd's or dvd's that automatically run when you insert it. This file is hidden, and if you encounter this kind of file in your hard disk drives you should suspect it as a virus. To verify further, open the command prompt and go to the main directory and type C:\>type autorun.inf. You will be able to see here the associated virus files and usually it ends with the extension ".exe"
3. Use an anti spyware and registry blocker software like spybot search and destroy. Its free!