What is Ahsan?

Ahsan is a computer Virus.

Symptoms:

* My Computer is renamed to "Ahsan's computer"
* Recycle bin is renamed to "GW Bush"
* One can't access "Task Manager"
* Can't execute any "exe" file specially the one for any antivirus etc.
* Registry editing is disabled.
* One can't access the hidden files.

Remove Ahsan virus from computer.

Follow these steps to remove Ahsan's virus from your system.

1. start windows in safe mode in with command prompt.

2. use RRT Tool to enable run " if disabled". "Search in google"

3. Enable regediting if disabled with following reg key.

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f 4. Open regedit, search and delete all entries with name "Ahsan" , site 110mb.com and Bush.

1). If your folder option is disabled enable it with following reg key "

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Policies\Explorer

Check if a DWORD value named NoFolderOptions exists in the pane on the right hand side of the screen Delete it

2). If you are still unable to view the hidden files, which is disabled by virus, enable it with following proc and key.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced. Find the value "Hidden" .

Rightclick it and modify it to 1. If Key value hidden is not present create it

Check the following registery values and set the values given below in each registery key.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"CheckedValue"=dword:02
"ValueName"="Hidden"
"DefaultValue"=dword: 02

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword: 01
"ValueName"="Hidden"
"DefaultValue"=dword:02

1). Now enable "show all hidden files / Hidden system files and folders", and search for following files and delete them all.

system.exe
csrss.exe
Home video.avi.exe
autorun

Note: these files will be in parrent drives (D:, C:) and in windows folder.

2). Dont worrie, you are done. now restart your computer.

Ahsan virus removal

1. start windows in safe mode in with command prompt.

2. use RRT Tool to enable run " if disabled". "Search in google"

3. Enable regediting if disabled with following reg key.

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

4. Open regedit, search and delete all entries with name "Ahsan" , site 110mb.com and Bush.

HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Policies\Explorer

Check if a DWORD value named No FolderOptions exists in the pane on the right hand side of the screen Delete it

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced.

Find the value "Hidden" . Rightclick it and modify it to 1. If Key value hidden is not present create it

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN]
"CheckedValue"=dword:02
"ValueName"="Hidden"
"DefaultValue"=dword: 02

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword: 01
"ValueName"="Hidden"
"DefaultValue"=dword:02

system.exe
csrss.exe
Home video.avi.exe
autorun

Note: these files will be in parrent drives (D:, C:) and in windows folder.

9. Dont worrie, you are done. Now restart your computer.