Flu Burung Virus

30 October 2007 2 Comments

Flu Burung is a virus that can infect Microsoft Word .doc files by duplicating infected file with an executable .scr extension. The original version will be hidden so only the executable copy is visible to user. Flu Burung Virus will also replaced Internet Explorer title to show its presence and block access to security web sites.

Alias: W32.Rungbu

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Windows Vista

Technical Details and Additional Information:

What can Flu Burung Virus do to infected system?
- The virus will hide file extension on the affected system.
- Setup Microsoft Word as default program to run .SCR files.
- Hides all original Microsoft Word document.

Malicious Files Added by Flu Burung Virus
C:\Recycled\SVCHOST.EXE
C:\Recycled\SPOOLSV.EXE
C:\Recycled\CTFMON.EXE
C:\Recycled\SMSS.EXE
C:\Windows\Installer\{00000409-78E1-11D2-B60F-006097C998E7}\docicon.exe
C:\Documents and Settings\User\Local Settings\Temp\Flu Burung.txt

Flu Burung Virus – Removal

Removing Flu Burung Virus Manually:
1. If using Windows ME or XP, System Restore must be disabled to prevent the threat from restoring itself. [Windows XP System Restore]
2. Update the virus definitions.
3. Reboot Windows in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Exit registry editor and restart Windows.

Anti-virus Tools

In order to completely remove Flu Burung Virus from a system, it is best to download and run Malwarebytes Anti-Malware. Sometimes, Trojans will block the downloading and installation of MBAM. If this happens, download it from a clean PC and rename the executable file before executing on the infected machine.

Scan with Norton Power Eraser:
Norton Power Eraser is a virus removal tool created by Norton Antivirus to remove unfamiliar threats without using the traditional AV signatures. Download the tool and start scanning with Norton Power Eraser.