TinySigns

The best way NOT get infected by a virus is get a good ANTIVIRUS and NEVER trust anyone with a mobile drive in one hand. Try to recognize th tiny signs to avoid getting infected….

The FS6519.dll.vbs a.k.a. “TAGA LIPA ARE” (TLA) virus does nothing harmful to your computer system, here are some of its characteristics:

• copies itself to your write-enabled drives [A..Z] (That is if you have that many drives.)
• copies itself to the /ROOT/%windir%/ folder.
• changes the Internet Explorer titlebar to “TAGA LIPA ARE!”.
• disable changing of the default homepage in Internet Explorer.
• inability to double click drives (although, opening with right-click menu enables you to open the drive).
• cloned/copied/modified from Hacked By Godzilla & Taga ESI scripts by someone named F. E. SILVA

“It is just another scripting virus modified by some noob who got his hand on the codes” (a comment by a friend of mine.. Yet he got infected from it… shongaks ka kasi!) Just a tiny sign of his being uninformed! /heh

The best way to remove this one and not get infected is to get an antivirus, I would recommend NOD32 (since I use it and it easily detects a lot of virus that my other antivirus install couldn’t remove).

Another possible way is to manually, delete it from your computer, but I would not recommend you doing it because it requires you to edit some parts of the registry.

Although it would be easy, you might accidentally, modify or remove an important information stored in the registry, So I recommend to skip the steps (but if you are brave enough, and want to delete it manually go ahead and try it, but I warn you…) and just try this:

TLA-Remover by Leerz: TAGA.LIPA.NOOB.KILLER

I havent tested the program since I didn’t get infected, but I run a couple of antivirus on the zip file and it does not include any trojan/spyware/virus. The zip also comes with a details on how to remove the virus and its brothers (cloned from/copied from versions) which is different with mine (I have a more lengthy and careful way the step by step procedure, as in which one to press/edit/delete/click).

Removing the FS6519.dll.vbs Virus Manually

Dont tell me I didn’t warn you about editing the registry when your computer does not work after edit the Windows Registry.

Here is a step by step procedure (for those who do not have much knowledge about RegEdit) on how to remove the TAGA LIPA ARE! virus:

1. Connect all writtable-media that is suspected to be infected by the virus. (Anything that can be accessed and written by a computer)
   • Plug it into the usb port. (some are found infront of your system unit, some at the back)
   • Plug it into a card reader.
2. Open the task manager and end all process with an image name WSCRIPT.EXE.
   • To open Task Manager, Press CTRL+ALT+DELETE
   • In the Process List, look for a process named WSCRIPT.EXE, select if found then click “End Process” and YES, repeat this until there are no more WSCRIPT.EXE in the list.
3. Enable viewing of hidden files/Protected Operating System files/Extensions for known filetypes.
   • The Windows Explorer way: Open Windows Explorer (My Computer), Click on Tools>Folder Options menu
   • The Control Panel way: Click Start>Control Panel, Select Folder Options.
   • Now the Folder Option Dialog appears. Select the View Tab, On the Advance Setting select the Show hidden files and folders radiobutton, uncheck Unhide extenstions for known file types and uncheck Hide Protected Operating System files then click OK.
4. Delete the main files, FS6519.dll.vbs and autorun.inf.
   • Search for the following files on your drive (Not inside folders, the root of the drive. ex. C:\, D:\) FS6519.dll.vbs and autorun.inf
   • Delete the files by selecting both the files then pressing SHIFT+DELETE (this would not send the file to Recycle Bin)
   • Repeat the previous steps until every drive has been searched.
   • Go to the /ROOT/%SYSTEM%/ folder (mostly C:\Windows folder), and search and delete the FS6519.dll.vbs file.
5. Delete all instances of WSCRIPT and FS6519.dll.vbs in the Windows Registry.
   • Click Start>Run, type regedit and hit the Enter key
   • Now the fun part - Removing it from the registry…
   • To delete an entry in the registry, select the entry you want to delete and press the DELETE key, then answer YES to the confirmation popup.
   • To edit an entry in the registry, right click on the selected entry and select modify. After modifying, click OK.
   • To eradicate every Search for it… (why Search? I came across some entry of the file in other parts of the registry aside from the start-up area: ‘HKLM\software\Microsoft\Windows\CurrentVersion\Run\‘ while fixing a couple of my friends’ computers)
   • Try to search for the following entries: FS6519.dll.vbs and WSCRIPT.EXE. Press CTRL+F and type the word to look for. Now, Press F3 if you want to search again for the same ‘word’
   • Sometimes searching you would encounter the following entries \WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs, I know that deleting the ,ShellExec_RunDLL wscript.exe FS6519.dll.vbs
     part of the entry does not have anything the script nor your computer, but just for the sake of being extra careful, remove it anyway.
6. The next part would be, Editing the Internet Explorer Title…
   • Again, you can easily do this by searching for it in the Windows Registry, just Find TAGA LIPA ARE!, modify it or just leave it blank.
7. The last part is a little bit tricky… Ask the following to yourself…
   • …why didn’t I purchase/downloaded a good Antivirus that would have prevented me from reading this lengthy way of dealing the TAGA LIPA ARE! virus
   • …why am I still using Internet Explorer as my browser?
   • …why am I still reading this part of this article?

There you go! I hope this lengthy article provided you with the help you are seeking and hope you learned some lessons…

• Go get some better protection, better yet get a couple more alternative protection… One antivirus is not enough! I learned that the hard way a couple of months ago, when my system got corrupted and crashed. But that’s another story…
• Go get a better browser! Try

As the organizations are expanding from continent to continent, the need of data backup is mounting. These giant organizations prefers remote backup for their backup system. These organizations are using data recovery system to recover that data which is accidentally deleted. There are lots of organizations which developed their own data recovery program which is totally customized according to their specifications. The online file sharing is also gaining popularity day by day especially in companies where remote employees chat regularly with someone at the home office. To secure the data there is a need of backup computer files regularly. In the future it seems there will be lot of ISPs which will provide free internet with their other services.
The virus is not a good way of getting attention, a better way for the ‘noob’ virus maker to get some chick-action is to join and win in different programming contests… Or he might try to jump from a 50-storey building if his life isn’t worth anything any longer! He really gave me a lot of computer repairs this past few days, not that I didn’t to fix computers because of the virus, but it’s just annoying that a lot of them were from computer shops, image me searching and cleaning 20~30 computers. Running the regedit in each one those computers, I wish I had the TLA remover during those time…

These are just tiny signs that showing us that we need to constantly protect ourselves from computer viruses… When will you recognized those tiny signs around?