How to remove Taga Xpress On Kami

MANUAL REMOVAL INSTRUCTIONS
Terminating a Process

This procedure terminates the normal process WSCRIPT.EXE, which is used by this malware to execute. Terminating this file also terminates the malware.

1. Open Windows Task Manager.
On Windows 98 and ME, press
CTRL+ALT+DELETE

On Windows NT, 2000, XP, and Server 2003, press
CTRL+SHIFT+ESC, then click the Processes tab.

2. In the list of running programs*, locate the process:
WSCRIPT.EXE
3. Select the malware process, then press either the End Task or the End Process button, depending on the version of Windows on your computer.
4. To check if the malware process has been terminated, close Task Manager, and then open it again.
5. Close Task Manager.

*NOTE: On computers running Windows 98 and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process.If the process you are looking for is not in the list displayed by Task Manager or Process Explorer, continue with the next solution procedure. If the malware process is in the list displayed by either Task Manager or Process Explorer, but you are unable to terminate it, restart your computer in safe mode.

Enabling The Registry Editor

This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:

On Windows 98 ME, NT, and 2000:

1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:
REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] “DisableRegistryTools” = dword:00000000
3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

On Windows XP and Server 2003:

1. Open the Run dialog box. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:
REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f
3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

Removing Autostart Entry from the Registry

This solution deletes/modifies registry keys/entries added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer’s registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
{random} = “%Windows%\{random}.dll.vbs”
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)

Removing Other Entries from the Registry

1. Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Policies>Explorer
2. In the right panel, locate and delete the following entries:
* NoFind = “1?
* NoFolderOptions = “1?
* NoRun = “1?
3. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Policies>System
4. In the right panel, locate and delete the entry:
DisableRegistryTools = “1?
5. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Internet Explorer>Main
6. In the right panel, locate and delete any of the following entries:

* Window Title = “Hacked by Godzilla”
* Window Title = “Hacked by MOOzilla”
* Window Title = “Hacked by UC”
* Window Title = “Hacked by YaHaa, Your Firewall Is FUCK.”
* Window Title = “Hacked by Zay”
* Window Title = “Malaysian Hackers”
* Window Title = “Protected by CPCT”
* Window Title = “TAGA ETI, MARINDUQUE MABUHAY!!! by: Nicklaus S. Buñag”
* Window Title = “TAGA LIPA ARE!”
* Window Title = “TAGA XPRESS-ON KAMI”

7. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>cmd.exe
8. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
9. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>install.exe
10. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
11. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>msconfig.exe
12. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
13. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>regedit.exe
14. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
15. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options> regedt32.exe
16. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
17. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>RegistryEditor.exe
18. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
19. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>Windows NT>
CurrentVersion>Image File Execution Options>setup.exe
20. In the right panel, locate and delete the entry:
Debugger = “notepad.exe”
21. Close Registry Editor.

Deleting AUTORUN.INF

1. Right-click Start then click Search… or Find…, depending on the version of Windows you are running.
2. In the Named input box, type:
AUTORUN.INF
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then open with Notepad. Check if it contains the following strings:
shellexecute=wscript.exe {random}.dll.vbs
5. If the said strings are found, close Notepad, select the file then press SHIFT+DELETE.

Resetting Internet Explorer Home Page and Search Page

This procedure restores the Internet Explorer home page and search page to the default settings.

1. Close all Internet Explorer windows.
2. Open Control Panel. Click Start>Settings>Control Panel.
3. Double-click the Internet Options icon.
4. In the Internet Properties window, click the Programs tab.
(Note: If you are running Internet Explorer 7 (IE7), click the Advanced tab.)
5. Click the Reset Web Settings… button.
(Note: On IE7, click the Reset… button. Note that by doing this, you are resetting IE back to its default settings.)
6. Select Also reset my home page. Click Yes.
7. Click OK.

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).