Description of Worm:Win32/Chupik.A
Worm:Win32/Chupik.A is a Visual Basic-compiled worm that propagates via fixed media; for example, a hard disk drive or flash drive. It may also download files, possibly malicious, onto your computer. Worm:Win32/Chupik.A is a terrible worm parasite that usually bundled with other variants of the family. Once it successfully intrudes your PC, it will reproduce itself very quickly to occupy every corner of the OS, thus making itself be a very dogged virus so that the antivirus cannot delete it completely. The worm will drop the files below on your PC when it installs itself: %windir%\h2s.exe %windir%\nacl.exe %windir%\system\lsass.exe %windir%\userinit.exe phim hai cuc hay.exe tuyen_tap_hai_2008.exe It also change the following two registry subkeys: In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Sets value: "pikachu" With data: "C:\WINDOWS\nacl.exe" In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Modifies value: "Userinit" With data: "C:\WINDOWS\system32\userinit.exe," To value: "Userinit" With data: "C:\WINDOWS\userinit.exe" Usually, Worm:Win32/Chupik.A launches every time the computer starts and seriously damage the system if not removed in a prompt time. Various antivirus programs can’t remove the virus, with some of them not being able to detect it. This Worm:Win32/Chupik.A malware is so stick that DDS.scr runs for about a few minutes then locks the system up. Worm:Win32/Chupik.A a high risk to the safety of your personal information and should be removed from the system immediately.How to Remove Worm:Win32/Chupik.A step by step?
Step one. Reboot your computer and tap F8 repeatedly before Windows launches. In the Windows Advanced Options menu, select Safe Mode with Networking by using up and down arrow keys. Then press Enter.(ZP(%5B0JWT@%2585P7L8.jpg)
Step two: Press Ctrl + Alt + Delete to open the Task Manager, then click Processes tab, search for the process that associated with the worm and end it. Generally, the process name is composed of random letters and numbers.
Step three: Find the files that the worm has added to your computer and delete them all.
%AllUsersProfile%\{random}
{random}.exe
%AllUsersProfile%\{random}*.lnk
%WINDOWS%\system32\consrv.dll
%WINDOWS%\system32\Drivers\mrxsmb.sys
Step four: Delete the registry entries that the worm has created. Find the registry entries below and delete them all.
HKEY_CURRENT_USER\Software\ Microsoft\Windows\CurrentVersion\ Policies\system ‘DisableTaskMgr’ = ‘1’
HKCU\SOFTWARE\ Microsoft\Windows\CurrentVersion\Run\regedit32
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ “shell” = “[random].exe”
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments ‘SaveZoneInformation’ = ‘1’
Warning: It is risky to modify the system registry because that any valid registry deletion can lead to severe system damage. If you are a regular computer user, please use a professional removal tool to delete the infection. It can scan your PC entirely and remove all the malicious files with only a few clicks of the mouse. Click here to learn more about virus removal.
