Home » Worm » Surabaya

Surabaya

27 September 2008

“Surabaya in my birthday” is a Windows start-up worm that will appear during boot-up. It spreads on computer and comes embedded with File Sharing applications. It displays a message on Windows start-up:

Surabaya in my birthday
Don’t kill me, i’m just send message from your computer
Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku
Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal
Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0

Aliases:
-

Risk Level: Low

File Size: Varies

Affected System: Windows

No related posts.

31 Comments »

  • 1 }
    RAN Pogi said:

    How can i remove this message? Surabaya in my birthday
    Don’t kill me, i’m just send message from your computer
    Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
    Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku
    Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal
    Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0

    7 October 2008 at 2:45 pm
  • 2 }
    justin said:

    Delete below lines from your windows registry via regedit

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    LegalNoticeCaption = 81u3f4nt45y – 24.01.2007 – Surabaya
    LegalNoticeText = Surabaya in my birthday. Don’t kill me, i’m just send message from your computer. Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti. Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0.

    11 October 2008 at 8:27 am
  • 3 }
    andrew said:

    any other way to delete this startup virus…. or remover for this virus

    i noticed that all my folders in Drive C and drive D was hidden and i cant unhide using the folder option…

    14 October 2008 at 10:01 am
  • 4 }
    durgesh said:

    Surabaya in my birthday
    Don’t kill me, i’m just send message from your computer
    Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
    Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku
    Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal
    Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0

    plz,tell me how to remove it i always reboot my pc and afterwards opening some files from d or e drives again it catch the same things help me……………………….

    20 October 2008 at 11:15 am
  • 5 }
    daniel said:

    i follw the instruction how to remove the virus surabaya but its still there it not remove the virus surubaya.Is der other way how to remove that virus can you help me pls tnx

    20 October 2008 at 1:49 pm
  • 6 }
    durgesh said:

    Delete below lines from your windows registry via regedit

    to open regedit:GPEDIT.MSC>disable registry tool

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
    LegalNoticeCaption = 81u3f4nt45y – 24.01.2007 – Surabaya
    LegalNoticeText = Surabaya in my birthday. Don’t kill me, i’m just send message from your computer. Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti. Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0.

    it works thanks

    21 October 2008 at 8:58 am
  • 7 }
    qwerty said:

    i followed the steps on how to remove the message but after i’ve done it, it is still there. is there any way to remove this?

    28 October 2008 at 12:36 pm
  • 8 }
    Suhas Dhoke said:

    It really works. Thanks.

    29 October 2008 at 4:30 am
  • 9 }
    Prem Kumar said:

    Surabaya in my birthday
    Don’t kill me, i’m just send message from your computer
    Terima kasih telah menemaniku walaupun hanya sesaat, tapi bagiku sangat berarti
    Maafkan jika kebahagiaan yang kuminta adalah teman sepanjang hidupku
    Seharusnya aku mengerti bahwa keberadaanku bukanlah disisimu, hanyalah lamunan dalam sesal
    Untuk kekasih yang tak kan pernah kumiliki 3r1k1m0

    plz,tell me how to remove
    this Virus..i had tried Norton2007,Nod32,QuickHeal And AVG antivirus also. but no good feedbacks. All Files become double.Plz Help

    4 November 2008 at 5:23 pm
  • 10 }
    yamex said:

    we got the same problem with surabaya virus,it keeps coming back on our PC after we delete it several times. please help it’s affecting our business.

    5 November 2008 at 8:52 am
  • 11 }
    webmaster (author) said:

    1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
    2. After downloading, double-click on mbam-setup.exe to install the application.
    3. Follow the prompts and install as “default” only
    4. Before the installation completes, check on the following prompts:
    - Update Malwarebytes’ Anti-Malware
    - Launch Malwarebytes’ Anti-Malware
    5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
    6. Scan your computer thoroughly.
    7. When scanning is finished click on the “Show Results”
    8. Make sure that all detected threats are marked, click on Remove Selected.
    9. Restart your computer.

    Note: Surabaya may prevent mbam-setup.exe from downloading and running. You can download and rename this program from a different computer before running it on infected system.

    5 November 2008 at 10:08 am
  • 12 }
    miharu said:

    i cant find the LegalNotice Caption? please help me

    17 December 2008 at 6:22 pm
  • 13 }
    Jeph Reodica said:

    Thanks! It really works!

    30 December 2008 at 7:41 am
  • 14 }
    Endi said:

    thanks for information….

    16 January 2009 at 1:02 am
  • 15 }
    Kaustubh said:

    I have manually removed legal notice caption but when i made double click on any drive it says thumbs.db not found.. how to get rid of it.?

    19 January 2009 at 11:47 am
  • 16 }
    khaycee said:

    hi,i tried the regedits to delete the surabaya virus. but sadly my pc breakdown. i reststart it and wen the windows xp come out it turns into a black page/blank page. help me.. wat shud i do? plzzz do help me…

    10 February 2009 at 3:45 am
  • 17 }
    microtech said:

    help!… my folder suddenly became scr/screensaver file. there are also some folder that appears and i can’t remove it… ($recycle.bin,config.msi).. I also encounter a surabaya message at the start up… is surabaya and the changing of my folder properties have connection?? will you please give some solution about this…please…
    mbam can’t find the surabaya: i can’t remove the message!!!
    T_T

    12 February 2009 at 3:11 am
  • 18 }
    haha said:

    wa so boliao o!!!!

    17 February 2009 at 2:53 am
  • 19 }
    help said:

    my registry edit is disabled. how can i perform the steps!?? help

    13 March 2009 at 5:06 pm
  • 20 }
    Sunil Saini said:

    Editing the registery really works for removing the message saurabya in my friend ……….. from the startup screen. but still i am unable to enable hide file Extensions.

    21 March 2009 at 8:45 am
  • 21 }
    Rahul said:

    Not ablr to find legal notice caption. is procedure different for Win-Vista…as I have Vista in my laptop…

    Pl help.

    10 April 2009 at 6:12 pm
  • 22 }
    Gopi said:

    Thank you guys so much, i was able to remove the virus. Thank you once again.

    13 January 2010 at 10:26 pm
  • 23 }
    suraj said:

    Press Start -> Run -> cmd (or command) -> press Enter
    Type in command box- cd\
    Type again in command box- c:
    Type again in command box- attrib -s -h -r /d /s -> press Enter
    Type again in command box- del autorun.inf -> press Enter
    Type again in command box- del thumb*.* -> press Enter

    5 February 2010 at 8:02 am
  • 24 }
    panu said:

    do the above for all ur drives

    5 February 2010 at 8:03 am
  • 25 }
    pankaj said:

    how to removed surabaya birthday virus for regedit with edit solution & removal tools.

    7 March 2010 at 11:13 am
  • 26 }
    teja said:

    the above steps r not working….!!!

    29 March 2010 at 12:37 pm
  • 27 }
    teja said:

    plz tell me tool for removing surabaya my birthday virus……..

    29 March 2010 at 12:39 pm
  • 28 }
    arnel said:

    how to remove this surabaya virus in my pc pls….

    11 June 2010 at 12:34 pm
  • 29 }
    jen said:

    attrib-s-h-r/d/s are invalid switch

    24 October 2010 at 11:17 am
  • 30 }
    Summit said:

    hey jen
    copy paste this
    attrib -r -h -s /d /s

    6 December 2010 at 3:46 pm
  • 31 }
    kevin said:

    Hi, i have the same problem popup ‘Surabaya in my birthday’ on boot and my system goes to a blank screen with just the cursor. i tried booting to safemode but it shuts down after it loads few files. what do i do ?

    5 January 2011 at 1:07 pm

Leave your response!

Add your comment below or subscribe to these comments via RSS.
Be nice. Keep it clean. Stay on topic. No spam.