Long Live Sowar » How to Remove sowar.vbs Virus

Here's a step-by-step guide to remove one of the most annoying virus ever - Long Live Sowar (sowar.vbs) Virus.

What sowar.vbs does. When first run VBS/Autorun-FM copies itself to:

Root\Cool USEP Scandal.vbs
Root\sowar.vbs
Windows\SysRes.vbs

and creates the following files:

Root\Autorun.inf
Windows\%ORIGFILENAME%

Whenever a removable drive is inserted, the following files are copied over:

Autorun.inf Cool USEP Scandal.vbs

The following registry entry is created to run SysRes.vbs on startup:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run System Restore wscript.exe "Windows\SysRes.vbs"

VBS/Autorun-FM changes settings for Microsoft Internet Explorer by modifying values under:

HKCU\Software\Microsoft\Internet Explorer\Main\Start Page

How to Remove sowar.vbs (Long Live Sowar) Virus

1. Go to Start, Run and type: cmd press Ok.

2. At the command prompt, type in your primary drive location, usually C:

3. You may need to change the directory. If so type: cd \ hit Enter.

4. Type: attrib -s -h -r -a autorun.inf hit Enter.

5. Type: dir and hit Enter. This will allow you to see and confirm the Autorun files.

6. Type: del autorun.inf hit Enter. Repeat the above commands for each drive on your computer including your flash/usb drive.

7. Now search for and remove sowar.vbs, SysRes.vbs, Cool USEP Scandal.vbs

• At the command prompt, type in your primay drive location, usually C: hit Enter.
• Type: attrib sowar.vbs.* -s -h -r -a hit Enter.
• Type: dir /s sowar.vbs Hit Enter.

8. If the file is present, type: del sowar.vbs hit Enter.

• Repeat the above commands for each drive on your computer including your flash/usb drive.
• Then repeat these instructions to search for and delete SysRes.vbs, Cool USEP Scandal.vbs on each drive if present.

9. Exit the command prompt and reboot normally.

10. Disable autorun.