From Emre virus labs:

This motherfucker virus was living in my parents` computers. (Since I use Linux I don`t have any as usual…) And it`s a pain in the ass…

What the virus does:

  • Shares your drives to the world as PATRON1, PATRON2, etc…
  • Copies itself to any writeable devices around you. USB sticks are great examples.
  • On a USB drive, it generates an autorun.inf file and a copy of itself. Each time you connect your USB drive it infects your computer again…
  • It uses the CPU at least to 70%… Noisy bitch…

How do you know that you are infected:

  • Press CTRL+Shift+Esc buttons. You`ll see the activexdebugger32.exe process running.
  • You can see a copy of the executable (activexdebugger32.exe) in your USB drives if you enabled the STUPID Windows to show you hidden files.

How to kill the bastard and have a nice smiley day/night (It`s 3am ok?) If you kill your computer i`m not responsible.

  • Plugin your USB stick (if you have one)
  • Kill the process activexdebugger32.exe
  • Delete the activexdebugger32.exe binary. It usually lives under c:windowssystem32 (or c:winntsystem32 depending your Windows installation)
  • open regedit. Go to the top of the tree on the left pane. hit F3 (or CTRL+L) to open the search dialog. type, yes you know it, activexdebugger32.exe, NUKE the damn registry entries wherever it`s found. (Search until the end)
  • Go to the root folder of your USB stick and delete, yes you`re right again, activexdebugger32.exe and autorun.inf
  • Update: Motherfucker leaves more trails… Delete the file NESNELER.EXE (meaning objects.exe in turkish) under c:Documents and SettingsLocal SettingsTemp
  • Update: Delete all the files under C:windowssystem32 named: Ijl11.dll, KMON.OCX, KTKBDHK3.DLL, MSWINSCK.OCX, PAC, scrrntr.dll, scrrun.dll
  • Done.

Lastly, fuck microsoft and windows, have a nice life….

Update after 4 months: Damn I was angry when I wrote this. And it was 3 am. The entry was somewhat full of typos so i edited and changed some info. :P