Remove Surabaya virus.

Surabaya in my birthday
Don't kill me, i'm just send message from your computer
Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku
Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal
Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0


Is it the message that displays before you log in to your systems ,Then your system has been affected by surabaya virus.

How to remove it.

First of all:-

Stop Surabaya in My Birthday Virus processes:

explorce.exe
explorcr.exe

Delete Surabaya in My Birthday Virus files:

autorun.in

Now proceed as under:-

• First step:-

Search your hard discs for surabaya keyword. And now delete all files you get on this search

• Second step:-

Open Task manager and go to process tab. If you find there Surabaya process then end that process.

• Third step:-

Your Folder Option May not be working.

1)go to start>Run.
type regedit

now go to following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
now set CheckedValue to 1.

its done.
Try this solution only when you have some knowledge about Registry.

otherwise download this file and run it.

Download http://rapidshare.com/files/302380179/NMshf.exe

• Fourth step

To remove Message

download this tool
http://rapidshare.com/files/302380693/showmessage.exe and click remove message

OR

Go to start>run>type "regedit"

go to registry key.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and edit the following values

"LegalNoticeCaption", "LegalNoticeText" ,delete the message saved to them.

it will look like

"LegalNoticeCaption"=""
"LegalNoticeText"=""

• Fifth step:-

Again go to regedit ,Press ctrl+F type surabaya.
If you find any registry entry hen delete it.

Now to delete surabaya DLL files.

1. First locate Surabaya in My Birthday Virus DLL files you want to delete. Open your Windows Start menu, then click “Run.” Type “cmd” in Run, and click “OK.”
2. To change your current directory, type “cd” in the command box, press your “Space” key, and enter the full directory where the Surabaya in My Birthday Virus DLL file is located. If you’re not sure if the Surabaya in My Birthday Virus DLL file is located in a particular directory, enter “dir” in the command box to display a directory’s contents. To go one directory back, enter “cd ..” in the command box and press “Enter.”
3. When you’ve located the Surabaya in My Birthday Virus DLL file you want to remove, type “regsvr32 /u SampleDLLName.dll” (e.g., “regsvr32 /u jl27script.dll”) and press your “Enter” key.

Thats it you have done.


Guys please give your comments if your PC is now working fine, using this procedure..

N-joy