Antivirus World Forum

Re: jitux.a virus

Posted By: Me
Date: Friday, 17 June 2005, at 1:55 p.m.

In Response To: jitux.a virus (armando gallegos)

Ashtree fix

--------------------------------------------------------------------------------

I had the same problem. About every minute a routine would start typing "LOL you retard!" in whatever program I was in. I don't recall doing anything specific and believe the virus came through messenger. I found a solution on the web. You can verify by searching for "msapl32" to see that it's a bogus file. I have successfully removed it by doing the following:

1. Boot your computer in safe mode (F8). Doing so will not allow "Ashtree" to start.

2. Go to Start, Run, and type regedit

3. Search and remove all occurences named or containing msapl32 and mswindrv. Note: I didn't find any occurences of mswindrv the first time. I found some after removing Ashtree.txt in step 5 and running regedit again.

4. Go to windows explorer and search for maspl32 and mswindrv and remove them. Make sure you have the "search for hidden files" checked.

5. Search for Ashtree and remove it. It should be an Ashtree.txt file that says something like "Ashtree is Sexy".

6. Run regedit again searching for msapl32 and mswindrv and remove any found files.

7. Reboot your computer in the normal mode.

Good luck

Messages In This Thread

jitux.a virus
armando gallegos -- Friday, 27 May 2005, at 10:20 p.m.

Re: jitux.a virus
Me -- Friday, 17 June 2005, at 1:55 p.m.

buy and forget
buy and forget -- Monday, 5 November 2007, at 9:22 a.m.

pcomCKNGzfAXbSoQnXn
ipndvnzgx -- Thursday, 29 May 2008, at 2:39 a.m.

qOoKgQyJNAtxyS
joseph -- Tuesday, 24 June 2008, at 7:48 p.m.

gGgVDMNnEuLeTIDAZg
Uxerbiaw -- Wednesday, 25 June 2008, at 10:11 p.m.

qDXfvEhbeNHbrK
Ctymqama -- Thursday, 26 June 2008, at 5:12 a.m.

yCaJJNqHuibv
Suxmoiyj -- Sunday, 29 June 2008, at 9:06 a.m.

PtCvbZHMPcmh
Olxtqoce -- Sunday, 29 June 2008, at 11:36 p.m.

kgoEwcTNzfOdOel
Buykobyl -- Monday, 30 June 2008, at 2:28 p.m.

pVZKSEXVIjxX
Grzqfcfz -- Tuesday, 1 July 2008, at 4:41 p.m.

oeTNHJTRJQzpNTVcYGM
Pvqttlub -- Wednesday, 2 July 2008, at 1:57 p.m.