Cleaning Donal Bebek Virus without antivirus

1. Disable Network Connecction
2. Turn Off "System Restore"
3. Kill virus process
4. Copy this code to Notepad or your text editor

[version]
signature="$chicago$"
provider=vaksincom oyee


[defaultinstall]
addreg=unhookregkey
delreg=del

[unhookregkey]
hklm, software\classes\batfile\shell\open\command,,,"""%1"" %*"
hklm, software\classes\comfile\shell\open\command,,,"""%1"" %*"
hklm, software\classes\exefile\shell\open\command,,,"""%1"" %*"
hklm, software\classes\piffile\shell\open\command,,,"""%1"" %*"

hklm, software\classes\regfile\shell\open\command,,,"regedit.exe "%1""
hklm, software\classes\scrfile\shell\open\command,,,"""%1"" %*"
hklm, software\microsoft\windows nt\currentversion\winlogon, shell,0, "explorer.exe"
hklm, system\controlset001\control\safeboot, alternateshell,0, "cmd.exe"
hklm, system\controlset002\control\safeboot, alternateshell,0, "cmd.exe"
hklm, system\currentcontrolset\control\safeboot, alternateshell,0, "cmd.exe"
hklm,software\microsoft\windows\currentversion\explorer\advanced\folder\superhidden, uncheckedvalue,0x00010001,1
hklm, software\microsoft\command processor, autorun,0,
hklm,software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall, checkedvalue, 0x00010001,1
hklm,software\microsoft\windows\currentversion\explorer\advanced\folder\hidden\showall, defaultvalue, 0x00010001,2
hkcu, software\microsoft\command processor, autorun,0,

[del]

hkcu, software\microsoft\windows\currentversion\policies \system, disableregistrytools
hkcu, software\microsoft\windows\currentversion\policies \system, disabletaskmgr
hkcu, software\microsoft\windows\currentversion\policies \explorer, nofolderoptions
hkcu, software\microsoft\windows\currentversion\policies \explorer, nofind
hkcu, software\microsoft\windows\currentversion\policies \explorer, norun
hkcu, software\microsoft\windows\currentversion\policies \winoldapp
hklm, software\microsoft\windows nt\currentversion\image file execution options\payxx.exe
hkcu, software\microsoft\windows nt\currentversion\winlogon, shell
hklm, software\microsoft\windows\currentversion\explorer \advanced\folder\hidden\hidefileext
hklm, software\microsoft\windows\currentversion\explorer \advanced\folder\hidden\showfullpath
hklm,software\microsoft\windows\currentversion\explorer \advanced\folder\hidden\showfullpathaddress
hklm, software\microsoft\windows\currentversion\explorer \advanced\folder\hidden\superhidden
hkcu, software\microsoft\windows\currentversion\policies \explorer, nofolderoptions
hkcu, software\microsoft\windows\currentversion\policies \system, disableregistrytools


5. Save file name as = repair.inf

=> Right-Click repair.inf
=> Click install

6. Show Hidden and SuperHidden file:

- Open Windows Explorer
- Click menu “Tools” | Folder Option
- Click “View”
- and select “Show hidden files and folders”
- Uncheck “Hide protected operating system files (recommended)”



- Click “Apply”
- Click “Ok”



7. Search and delete file:

=> Size = 53 kb
=> Extension = exe
=> File Type = "application"



8. To optimal cleaning,install anti virus