Ahsan’s Computer Virus Solutions

Http://pakdata.net

by

Shahzad Arain

Shahzad.cdcu@gmail.com

There are many solutions out there. You will have to delete registry keys associated with the name
ahsan, delete some hidden files from every drive of your PC, delete running processes related to Ahsan
from task manager being in safe mode. You can do it manually or you can just download some
softwares to do that.

Method 1
Download and run True Sword Threat Remover (Assumed that you have installed default location: After
installation, open folder name “True Sword Patch” and copy the “TrueSword4.exe” then replace it on “C:\Program
Files\True Sword 4” ) by Security Strong Hold. True Sword will find and fully remove AHLEM.A
(csrss.exe) and other dangerous threats including trojans, spyware, adware, riskware, problemware,
keyloggers, dialers, viruses and other kinds of malicious programs in several seconds.

Method 2
Download Ahsan's Computer Process Killer
Run this tool and all running processes by Ahsan virus will be demolished.
Download Search Everything Tool
Find and delete all files specified below:
system.exe

csrss.exe

Home video.avi.exe

autorun.inf

Note: The original csrss.exe file is only placed in System32 directory. You should NOT delete that file
placed in C:\Windows\System32 directory because its the system file. Delete all other files named as
csrss.exe at other locations.
Go to Start > Run > Regedit > Enter. Press F3 and the Find dialog box will appear. Find and delete the
reference to all the following:
system.exe
csrss.exe

Home video.avi.exe

Note: You should NOT delete the registry key which specifies csrss.exe in System32 directory. Delete
all other file values for other locations.
Use the Smart Virus Remover to reset the Windows settings to default.

Method 3
 Download Process Explorer, extract the archive and run it by clicking procexp.exe. Kill all the
process with name Firewall.exe , CSRSS.exe shown in process explorer.
 Download Search Everything Tool, find and delete all the files with following names.
system.exe

csrss.exe

Home video.avi.exe

autorun.inf

Note: Delete csrss.exe files found outside C:\Windows only and autorun.inf files in C:\Windows and in
the root directory of all the drive like C, D, E drive and your removable pen drive etc. If you reinstall
OS again as a fresh, this virus will be still there in other drives. Unhide system hidden files and enable
option "show hidden files". If you will now visit other computer drives, there will be Home
video.avi.exe and csrss.exe. Delete these.
 Log in to safe mode as Administrator
 Go to Start > Run. Copy and paste the following command given below and press enter.
REG add HKCU\Software\ Microsoft\ Windows\CurrentV ersion\Policies\ System /v
DisableRegistryTool s /t REG_DWORD /d 0 /f

 Go to Start > Run. Type regedit and press enter.

Search and delete all entries with name "Ahsan", "site 110mb.com" and "Bush".
 Navigate to the following registry path and delete any key value names with NoFolderOptions
HKEY_CURRENT_ USER\Software\ Microsoft\ Windows\Current Version\Policies\ Explorer

HKEY_LOCAL_MACHINE\ Software\ Microsoft\ Windows\Current Version\Policies\ Explorer

 Navigate to the following registry path

HKEY_CURRENT_ USER\Software\ Microsoft\ Windows\CurrentV ersion\Explorer\ Advanced. Find the
value "Hidden"

 Right click it and modify it to 1. If Key value hidden is not present there then you will need to
create it.
 Go to Start > Run. Type msconfig and press Enter.
  Locate the startup entries by ahsan virus and uncheck these entries.
Also make sure you remove any thing suspicious in Start Menu > All Programs > Startup Folder
 Uncheck the entries named "CRSS" and "A.M.K.B_Pk". Click apply and Ok.
 Restart now.

Method 4
System Restore to previous date can also remove this infection.
Goto start menu > All Programs > Accessories > System Tools > System Restore.

Spyware Removal Free Tools

Download and run Spybot - Search & Destroy
Download and run Spywareblaster.

RRT Tool
A tool to protect from and remove the most common restrictions made by malware. RRT re-enables all
what a virus had previously disabled, and gives you back the control over your own computer. These
restrictions are most often: - Disable Folder Options >> so the user can't set the option to show hidden
files! - Disable Registry Tools >> so the user can't see what is going on during system startup! - Disable
Ctrl+Alt+Del >> so the user can't see the virus and the other applications running! It also protects you
from any further infections that come from removable media. RRT with AutoRemove enabled monitors
your system and detects any flash disk as soon as it gets plugged in, blocks and remove any infection
before it makes any harm to your computer. RRT also protects you from any further infections that
come from removable media. Since we noticed that most of the malware nowadays spread via
removable media (Flash disks in specific).

Download RRT
Download RRT (don’t need to register it, trial version can work)
Run RRT and disable virus effects: check all check boxes and press 'remove'.

SDFix Trojan Removal Tool

SDFix is a program written by AndyManchesta that can remove many different types of Trojans and
Worms. SDFix will remove the known Trojans and Worms found on your computer.
Download SDFix

More Instructions
Scan your system with any online virus scanner to make sure that you’re clean. Here’s a list of online
virus scanners:

Free Online Virus Scanners

Symantec Security Check
Panda ActiveScan
Kaspersky Online Scanner
Mcafee FreeScan
Avast Online Scanner
F-Secure Online Scanner
Trend Micro Online Scan