Free Articles at Neutron Marketing Article Publishing and Distribution » Computers-and-technology » Software » Getting Rid Of The This Nasty Philippine Made Virus
Previous Article - Program To Renovate Your House Within Budget
Next Article - How To Avoid Frustration When Learning Adobe Illustrator

View PDF | Print View | Html Version
by: ZigfredDiaz
Total views: 5
Word Count: 714

Several weeks ago my computer got infected by a virus. I had a hard time removing the virus since as it still has no formal name as most of the anti-virus makers up to know have still not identified it. Try searching for a "remover" for this virus in google and you can see that you cannot find any. (Send me a message if you can find one) Luckily there are instructions on several websites on how to remove it. But there are only a few of these websites that bear such instructions. Probably the reason for this is because this virus is locally made. (made in the Philippines)

Before I start detailing to you how to remove it, let us first know the symptoms of the virus.

SYMPTOMS: 1.) When you open your internet explorer you see this annoying message in your title bar "TTMS NAA NA DIRE! DONT WORRY IM NOT A CORRUPT LIKE YOU!!" 2.) Go to "Start" > "Run" and type "regedit." Your computer will tell you that "Registry editing is disabled by your administrator" or something like that. 3.) If you go to windows explorer you can see a file called "TTMS???.vbs.dll" (The question mark stands for numbers, like TTMS123.vbs.dll) If fact you can see this file in all your hard drives, and there are usually from 1 to 4 files in each hard drive. You can also see this file in your c:\windows directory)

HOW TO REMOVE IT IN YOUR COMPUTER Step 1 - Delete the virus file in the registry

a.) You must first try to enable the registry. You can achieve this by going to Doug Knox's page. There, download a Registry enable/disable tool. (The tool requires you to reboot in order that you could access the registry) b.) After the reboot and once you get inside windows, press CTRL+ALT+DEL to bring up the task manager. Select "Processes Select "WSCRIPT.EXE" and click "End Process" c.) Activate the registry editor by pressing START > RUN > then type "Regedit" d.) The moment you are inside the registry editor go to EDIT > FIND type "TTMS.*" This will take you to all the files with the word "TTMS." Click on these and press delete. Do this repeatedly until you have deleted everything related to the TTMS virus. (However be careful in doing this there might be legitimate programs with the word "TTMS")

e.) To remove the annoying message in your Internet explorer title bar do the following in the registry editor: 1.) In the left panel, go to: HKEY_CURRENT_USERS>SOFTWARE>Microsoft>Internet Explorer>Main 2.) In the right panel, locate and modify the entry: From Window Title = "TTMS IS IN YOUR PC, DON'T WORRY I'M NOT CORRUPT AS YOU!" 3.) Change the value to Window title = "Microsoft Internet Explorer" 4.) In the left panel, locate the following: HKEY_USERS>%USERID%>SOFTWARE>Microsoft>Internet Explorer>Main NOTE: %USERID% is the current user ID in the registry. 5.) In the right panel, locate and modify the entry: From Window Title = "TTMS IS IN YOUR PC, DON'T WORRY I'M NOT CORRUPT AS YOU!", Change the value to Window title = "Microsoft Internet Explorer"

STEP 2 - It is important that you disable "System Restore" so that you will not reactivate the virus in case you go back to a restore point. Do this by going to START > SETTINGS > CONTROL PANEL > SYSTEM > SYSTEM RESTORE and check "Turn of system restore in all hard drives"

STEP 3 - Eradicate all virus strains. a.) Make your windows explorer show hidden files by going to WINDOWS EXPLORER > TOOLS > FOLDER OPTIONS > VIEW > HIDDEN FILES AND FOLDERS Click on "Show hidden files and folders" b.) Go to C drive by right clicking and selecting Open. Take note, do not double click the drive to prevent the virus from activating. c.) Tthere are usually 1 to 4 files which starts with "TTMS". Delete all these files. d.) See if there is an "autorun.inf" in the hard drives. If you see '[autorun]shellexecute=wscript.exe TTMS831.dll.vbs'. in the autorun.inf (You can open this via notepad) thene delete the file. e.) Do all of the above steps for all the other hard disks. especially for you C:\Windows folder.

About the Author

how to remove TTMS NA NA DIRE is not the only topic that Zigfred Diaz writes about. He also writes on several interesting topics including, money management, investments, How to invest in the Philippine stock market entrepreneurship, leadership, etc. Visit his blog today !

---

Rating: Not yet rated

--Choose-- 0 1 2 3 4 5

No comments posted.

Add Comment

Enter the code shown