W32.Hybris aka Hybris aka SnowWhite aka hahaha Removal

You are here: Home > Computer worms > Removal > W32.Hybris aka Hybris aka SnowWhite aka hahaha Removal

W32.Hybris aka Hybris aka SnowWhite aka hahaha Removal

This Removal Instruction is divided into five parts:

Restart the computer in Safe Mode
Set Windows to show all files
Edit the Win.ini file
Delete the plug-in file
Restore Wsock32.dll

Please perform all five steps for a complete removal. Do not forget to scan your computer with an updated Anti-Virus scanner after this removal to ensure that everything is back to normal. Please note that not all steps have to occur due to different ways of infection.

Part One : Restart the computer in Safe mode

Windows 95:
Step 1.
Exit all programs.

Step 2.
Click "Start", and then click "Shut Down". The "Shut Down Windows" dialog box appears.

Step 3.
Click "Restart", and then click "OK".

Step 4.
When "Starting Windows 95..." appears on the screen, press "F8". The "Windows 95 Startup Menu" appears.

Step 5.
Press the number that corresponds to "Safe mode" (usually #3), and then press "Enter". Windows will start in Safe mode.

Windows 98:
Step 1.
Click "Start", and then click "Run".

Step 2.
Type "msconfig" and then click "OK". The "System Configuration Utility" dialog box appears.

Step 3.
Click "Advanced" on the "General" tab.

Step 4.
Check "Enable Startup Menu", click "OK", and then click "OK" again.

Step 5.
Exit all programs.

Step 6.
Click "Start", and then click "Shut Down". The "Shut Down Windows" dialog box appears.

Step 7.
Click "Restart", and then click "OK". The computer restarts.

Step 8.
When the "Windows 98 Startup Menu" appears, press the number that corresponds to "Safe mode", and then press "Enter". Windows will start in Safe mode.

Note: If you have this spiral graphic and you are unable to do anything at all, perform a soft boot (Control+Alt+Delete) or perform a hard boot by turning your computer off using the power button and restart it.

Part Two: Set Windows to show all files

1. Start Windows Explorer (Start/Programs/Windows Explorer).

2. Click the "View" menu (Windows 95/98) or the "Tools" menu (Windows Me), and then click "Options" or "Folder Options", depending on whether you have Windows 95 or 98..

3. Click the "View" tab, and uncheck, if necessary, "Hide file extensions for known file types".

4. Click "Show all files" and click "OK".

Part Three: Edit the Win.ini file

Step 1.
Click "Start", and then click "Run".

Step 2.
Type sysedit and then click "OK".

Step 3.
Click the title bar of the Win.ini file.

Step 4.
In the [windows] section (you may have to scroll down to see it), locate the Run= line, and note what follows the = sign. For example, you may see: Run=C:\Windows\System\amiaamia.exe

Write down the file name, for example, amiaamia.exe.

Step 5.
Place the cursor to the right of the = sign and delete the text that follows it. When finished, it should look like: run=

Step 6.
Click the "File" menu, and then click "Exit". Click "Yes" when prompted to save changes.

Part Four: Delete the plug-in file

Step 1.
Click "Start", point to "Find", and then click "Files or Folders".

Step 2.
Make sure that "Look in" is set to (C:) and that "Include subfolders" is checked.

Step 3.
In the "Named" box, type the file name that you wrote down in step 4. (i.e. amiaamia.exe)

Step 4.
Click "Find Now".

Step 5.
When the file is found, select it, press "Delete", and then click "Yes" to confirm.

Restart the computer. Windows should restart normally.

Part Five: Restore Wsock32.dll

Windows 98:
Step 1.
Run the System File Checker - "Start", "Run" Type: sfc (Press Enter)

Step 2.
Choose "Extract one file..."
Type: c:\windows\system\wsock32.dll

Step 3.
Click Start, and where it says "Restore from" choose the location of your Win98 cd (Precopy1.cab) or cab files on your hard-drive. Where it says "Save file in"

Step 4.
Type c:\windows\system (Press Enter. )

Windows 95:
Step 1.
Click "Start", "Shutdown" Select: RESTART IN MS-DOS MODE

Step 2.
Insert your Windows 95 CD-ROM

Step 3.
Type:
EXTRACT /A D:\WIN95\WIN95_11.CAB WSOCK32.DLL /L C:\WINDOWS\SYSTEM (Press Enter)

The "D:" assumes your CD-ROM drive is "D:".

(Note that the above may vary depending on the version of Windows 95 you have:
Win95_11.cab = Windows 95 & Win95_18.cab = Windows 95 OSR2)

Restart the computer. Windows should restart normally.

Categories

Archives

W32.Hybris aka Hybris aka SnowWhite aka hahaha Removal

Advertising