Home » Trojan » W32/Hooon.worm NoooH – Please Try to open – TaskManager – now

W32/Hooon.worm NoooH – Please Try to open – TaskManager – now

5 June 2007

W32.Alnuh is a worm that copies itself to removable drives and closes Registry Editor, Task Manager, Command Prompt and Folder Options of Windows Explorer running on English and Arabic Windows. It displays a Message Box with

Title: NoooH and
Body: Please Try to open – TaskManager – now

Risk Level: Low

Alias: W32.Alnuh

Symptoms: It closes windows of the following process

  • \\cmd.exe
  • Folder Options
  • 32\\command.c
  • Windows Task Manager
  • Registry Editor

Displays a message window:

Related Files and Process:

  • C:\Windows\Web\Sys.exe

Related posts:

  1. W32.Spybot.Worm

    Overview: W32.Spybot.Worm is a detection for a family of worms that spreads using the Kazaa file-sharing network and mIRC. This worm...

16 Comments »

  • 1 }
    kinno_egy said:

    i tried removing the worm with kaspersky “updated”
    it removed it alreight but didnt fix the autorun problem from the hard drives
    ..
    i tried and tried and found out the solution
    here is the steps:
    1. start menu > Run > Regedit
    2. search for “Noooh”
    3. delete the file/folder
    4. open “My computer”
    5. Tools > Folder Options > View
    6. UnMark the “Hide Protected and operating System Files
    7. open each drive and delete “autorun.inf”
    8. Restart .. and it’s solved

    29 July 2007 at 5:00 pm
  • 2 }
    kazi chanchal said:

    sir my computer drive always autorun noooH command.

    17 September 2007 at 8:18 am
  • 3 }
    MAULIN THAKER said:

    sir,
    i want a free trial to hill “NooH” from my PC

    i will very thank full toyou if you do so .

    please send me the way to download free tial version becase i can’t delet the files.

    thank you very much for help

    21 September 2007 at 1:07 am
  • 4 }
    kemo said:

    hi , i need some help about (noooh)
    and autorun virus, it required me to open the hidden components in my computer .. so i wiil be to know how to remove it from my
    thanks… you can send email on my hotmail ..

    5 October 2007 at 8:54 pm
  • 5 }
    gina said:

    how to delete the nooh virus..nedd your help thanks

    25 October 2007 at 1:00 pm
  • 6 }
    fahar said:

    hi some one can help me about this this problem when i open my Pc he tell to open task manager and i won’t to remove this think thank you my e-mail sabilo.harfa@hotmail.com

    30 November 2007 at 7:18 pm
  • 7 }
    Rafeed said:

    Hi all,please I want help,cos my computer was infected by NooH

    11 December 2007 at 11:51 pm
  • 8 }
    ayman said:

    thank you

    14 December 2007 at 11:15 am
  • 9 }
    mai hudeeb said:

    plz help me to delte this viruse cuse am failed in this

    29 January 2008 at 7:41 am
  • 10 }
    compodia said:

    Hi ,please I want hlp cos my computer was infected by NooH virus. what can i do to remove this virus from my computer

    5 February 2008 at 2:40 pm
  • 11 }
    Taha said:

    dont click OK. It effect you if you click OKAY to it.

    8 February 2008 at 11:03 am
  • 12 }
    karim said:

    this is the solution

    1- Go into windows safe mode

    2- Don’t go into any harddrives ……..

    open control panel>>>>folder options
    uncheck: Hide protected operating system files (Recommended)

    3- Now RIGHT-CLICK on c:\ drive DOOOOO NOT DOUBLE CLICK!!!!!!!!!!!
    select: open

    you will find: sys
    autorun
    delete them

    Then go into c:\windows\web

    you will find: sys
    delete it

    Now RIGHT-CLICK on d:\ drive DOOOOO NOT DOUBLE CLICK!!!!!!!!!!!
    select: open

    you will find: sys
    autorun
    delete them

    repeat for all drives

    IF YOU DOUBLE CLICK RESTART AND START OVER

    4- Enter Start>>Run>> gpedit.msc

    This will get you into group policy

    Then: User config>>>> administrative templates>>>>> system
    Then: Ctrl +Alt+Del options

    Right click on each of the 4 choices and choose: properties

    In properties: choose: disable…

    Then go back and you will find: prevent access to registry editing tools
    Right-click>>>properties>>>>disable

    Your computer is healed

    Note: This worm is transmitted through flash drives and the like so plug in your flash drive

    AND RIGHT-CLICK>>>>>open DOOOOOOOOOOO NOT DOUBLECLICK or you go back to step 1

    you will find: sys
    autorun

    Delete them

    Your flash drive is healed

    for more info e-mail karim_psone@hotmail.com
    or call me on +21269066055

    29 February 2008 at 2:23 am
  • 13 }
    salah said:

    thanks a lot karim, it works!!!

    15 April 2008 at 1:53 am
  • 14 }
    KISHAN PATEL said:

    pleasa sir save my pc i am in major problem please sir do some thing

    23 May 2008 at 5:20 am
  • 15 }
    Max said:

    karim you are THE BEST IN THE WORLD!

    thanks for the guide, i removed the hated worm from my computer and my pen drive, THANK YOU VERY MUCH!

    7 October 2008 at 7:44 pm
  • 16 }
    PAREEK said:

    THANKS PAL KARIM. THAT WAS GENIUS. IT SOLVED MY PROBLEM. ONCE AGAIN A HELL LOTTA THANKS, SAVIOUR

    25 October 2008 at 11:46 pm

Leave your response!

Add your comment below or subscribe to these comments via RSS.
Be nice. Keep it clean. Stay on topic. No spam.