How to Remove “FS6519.dll.vbs” or If you Have “TAGA LIPA ARE!” in your IE
Symptoms: C: drive has an [autoplay] function when right-clicked. Internet Explorer has “TAGA LIPA ARE!” in it’s title bar.
Mode of Transfer: USB, Fixed/Portable HDD
Target: Internet Explorer, Registry, MSConfig, Autorun.inf
Effects: Every Mass Storage Device linked to the infected PC will be inserted with an autorun file which will trigger the Windows Scripting Service to run its main file “FS6519.dll.vbs”, which is marked as a system file and is in the root directory of the Drive.
to view the complete tutorial click here.
purple jellyfish said,
March 21, 2007 at 9:36 am
thanks a lot! that FS6519 really annoys me!!!!!!!!
however, i was unable to edit ny IE title. maybe i can do it tom.. thanks! really!
david said,
March 28, 2007 at 4:05 pm
can you help me out in my case? i have an annoying GET LINKED – GET CONNECTED stuff working in my IE instead of the TAGA LIPA ARE!. how can i remove it??! helo me please. i tried the taga lipa method but it doesn’t work. thankss. pls help
cel said,
March 28, 2007 at 4:11 pm
Hi, just want to know if you have any idea on how to remove a certain virus or trojan that has been pestering my pc for more than a week. My USB has been infected while using it in an internet shop. It was the FS8519. I was able to troubleshoot the pc but now, there’s another thing that has been plaguing my system. It’s like superimposed on the screen. It appears anywhere- XCEL, Word, even on my browser. I never really got to see the entire thing as I usually close it immediately but the first few words are these: system kompyuter anda kami or something to that effect.
Maybe you can help me with this. Thanks.
Jerel said,
April 1, 2007 at 2:44 pm
Thank you very much you save my day. Your good
Janice said,
April 5, 2007 at 4:15 am
very helpful site, thanks. just one question: why does double clicking drive c doesn’t work?
Erik said,
April 9, 2007 at 12:19 am
My thumb drive got infected, but it never transferd to any of my systems. I deleted the FS6519.dll.vbs file from my thumb drive, but do not see an autorun.ine (hidden files are shown). When ever I try to open my thumb drive it trys to autorun FS6519.dll.vbs, but can not because it can not be found, this is exibited on many different computers.
Any idea how to get rid of the autorun on my thumb drive?
Joel said,
April 9, 2007 at 6:31 am
Thanks a lot. now I can open my drives without that FS6519.dll.vbs thing. Keep it up!!!
oxen said,
April 11, 2007 at 6:28 am
I found some nice solutions to delete those files (I don’t know if it really solves the problem)
anyways, here it is…
I don’t know if it works with other programs (I am using Nero Burning Program, but i guess any non microsoft program would do), then when adding files to be burn(that is for Nero, for other programs just find a way that you’ll be able to browse your files),
Go to the root of your drive C: or your thumbnail drive, and delete the unnecessary files there… but then sometimes it just keeps on coming back…
anyways, that solution is for those people who can not find the files even if they change their Folder Options properties…
another solution would be (for thumbnail drives), you could copy the entire flash drive (just don’t use the Ctrl+a, it selects even the hidden files)…
Manually select the files (using the shift key, or ctrl key), then copy those files to a folder in your desktop,.. then format your thumbdrive, then you can copy your files back again to your thumbdrive..
dj said,
April 11, 2007 at 6:38 am
TIPS when using a flash drive (usb drive, thumbdrive)…
the main point here is DON’T trigger the AUTORUN, that is set by the FS6519.dll.vbs
NEVER use DOUBLE CLICK, it activates the autorun function, and spread the virus…
…to open your files, just use RIGHT CLICK and select OPEN, most of the time there would be two “Open”, just select the one which is not in bold letters… of course, never select autorun, or any other command except for the open (it’s much safer that way)…
…sometimes, when you do the RIGHT CLICK method, you could see all sorts of characters that doesn’t make any sense at all… one of the few ways to open the drive without potentially harming the system, is just typing the name of the drive in your address bar (F: G:), that way you could still open the drive without triggering autorun
reymund said,
April 13, 2007 at 1:05 pm
thank you very much…it helped a lot…i’ve got weeks of hard time ryt clicking on my hard disk just to click open…thank you…
sonnybaby ipost said,
April 17, 2007 at 5:15 am
a\ok ka bro, you made my day, regards to ala eh
sonnybaby ipost said,
April 17, 2007 at 5:17 am
but how can i fix my external’s autoplay, i also want to double click it.
the creator said,
April 19, 2007 at 6:30 am
hehehe ayos bah guys yung virus… modified version ko yan nung msvbl vb solo.dll mwahahaha. napakadali tangalin nyan…. filipino version. english version we fiipino’s done it again mwahaha. its just a simple worm that replaces ie and provides autoplay on explorer drives.. the original virus is far more extent for it slows down your pc duuuhhh… later guys for more virus for your pc hahahahaha…
vicki said,
April 22, 2007 at 4:19 pm
Just typed “taga lipa are” and lo and behold! complete instruction on how to delete this pesky virus.
Am putting a link of this post from my blog.
Thanks so much for the info! God bless.
Vicki
joel dhoodz said,
April 25, 2007 at 7:22 am
Thanks for the interesting info…now i can open all my drive w/out showing the FS6519..But i cannot get rid it to my IE… Try the Taga Lipa info…What shall i do w/ my IE guys?????????
dansoy said,
April 30, 2007 at 2:12 am
bro how about the worm.sohanad.al?? have solutions on this type of ,malware??? help!!!!
keenobserver said,
May 2, 2007 at 12:52 pm
hello, thanks for this info on removing this trojan virus.
i already deleted the file in the run in the regedit but my problem is i cannot double click my drive:C and drive:E.. what will i do?? can you please help me??
keenobserver said,
May 2, 2007 at 12:55 pm
so for asking question i did not read all the comment..
so i cannot double click any more in all my drives??
stargaezr said,
May 4, 2007 at 5:43 pm
thanks much!! now it’s gone
tina said,
May 7, 2007 at 1:50 am
panu ung destrukto na virus? worm din xa
tina said,
May 7, 2007 at 1:50 am
ung 10 utos ng manginginom
arik said,
May 9, 2007 at 1:26 pm
yup, i cant click my C: and D:’s anymore..
arfel said,
May 12, 2007 at 6:21 am
thanks in advance coz i know this could really works according to the testimonials of the other, my computer also infected with that worm
Naj said,
May 17, 2007 at 4:13 am
hi to the author of that virus..can i ask something weird on your virus, what i did when i got that. i try to edit that in notepad i delete all the text there and save again with your file name now,the problem is how i can restore my pc back to normal coz im having problem with auto play in drive c:\ but on other drive is ok. another problem is the Run in start is missing now i cant edit regidit,also the folder option is missing,i even cant do task manager. can you help me please sorry for my grammar.
candy said,
May 17, 2007 at 4:35 am
hi
i just want to ask
you said that this virus affects msconfig
i can’t find my msconfig anywhere
is that normal? is that bad for my computer?
thank you
candy said,
May 17, 2007 at 4:40 am
oh yeah.
i have another question
when i try to delete many things in my computer at once, a pop-up shows up claiming that it is being used by another PERSON or PROGRAM. is that also because of a virus that i don’t know of? is my computer being hacked or something? please help me with this. thank you again.
r0cks0ul said,
May 17, 2007 at 6:56 am
Hi this is caesar from the philippines I am familiar with the name of the trojan i know what it means He is definitely from the philippines I mean the author of the trojan “TAGA LIPA ARE” meaning “I AM FROM LIPA” a city here in the philippines located in BATANGAS its sad that I found one of these on my SD CARD and I immediately deleted it I tried to edit the vbs file yes it targets the registry and shows it on the Title Bar of the Internet Explorer I dont know from what school the author is from he might be from AMA college where the author of LUV BUG came from anyways thanks for the tutorial it might help a lot infected peepz who dont know how to remove it, It was few months since I found it even Our corporate network were infected.
omick said,
May 17, 2007 at 11:34 am
ei guys… to double click ur drives, be sure to delete the autorun.inf… ako, iba rin kac ung method ko… gamit ako ng command prompt to delete the files… ahmmm.. after deleting those files and the autorun, be sure to restart ur pc or if the problem is with ur usb, be sure to remove it first after the deletion of those viruses then insert it again to see if the process was successful…
Irvine said,
May 21, 2007 at 7:01 am
Thank you soo much! I was about to format my PC
arachnia said,
May 22, 2007 at 3:33 am
I cannot delete the autorun in my hardist containing the FS6519.dll.vbs. It said that the hardisk is write protected and the file is in use. I check it in the task manager if it is in use but it is not…..please help me….thanks!
nat said,
May 22, 2007 at 12:40 pm
paano po mag alis nung virus na Open (0) kung iright click mo yung drive? any suggestion
rico said,
May 23, 2007 at 6:52 pm
i’ve deleted the shit… but how can i change it the right click back into open… not autoplay… please answer me…
Winchor said,
May 25, 2007 at 12:55 am
Maraming Salamat!!! It bothered me for a long time.
I was thinking of reformatting my drives bcoz I thought it was hopeless.
Thank God, a friend told me about this Site!!!
Thank you very much!!!
johnny go said,
May 26, 2007 at 8:58 am
i have tried all the steps mentioned above..however when i double click the C drive and let my nod 32 scan the C drive,, said FS6519.dll butsur virus appears again…and what about the wscript.exe on windows folder/system 32? they keep on appearing even after i’ve deleted it…need some major help here….
james william campos said,
May 27, 2007 at 6:12 am
how to remove autoplay if you rigth click the icon of hardisk
jaena said,
May 28, 2007 at 5:18 am
Hi!
I had this taga lipa are on my IE and also when I double click my c drive it shows up the fs6519.dll.vbs too, I followed the instructions posted here to check show hidden files and uncheck Hide Extensions for known file type and Hide Protected operating system. I only found the 1 autorun.inf and found not a single fs6519.dll.vbs. I even searched it using search. what should I do? thank you in advance! 
eunice said,
May 30, 2007 at 7:00 am
hi, i was able to solve my drive C: but unfortunately my drive E: still cannot be opened and would prompt can not find script FS6519.dll.vbs… please help, i’m can’t find any autorun.inf and so with the FS6519.dll.vbs in my drive E:…. i really need help in this!!….
Asif said,
May 31, 2007 at 8:44 pm
hye
Asif here. Dear i have done all that you told me but could not find FS6519.dll.vbs entry on my registry . and i could not delete any hidden AutoRun.inf
i am having still problem whould you like to help me ? i am worries about that
kind regard
Asif +92 321 510 13 46
migs said,
June 1, 2007 at 2:42 pm
help! The FS6519 virus and it’s autorun.inf is in my external hard drive…I have done the steps to delete it from my desktop…but I couldn’t delete the ones in my external hdd…The file is corrupted and is unable to delete….what do I do? THanx!
jojo said,
June 2, 2007 at 9:14 am
hoy kupal gumawa k rin lng ng viruz mdali png tanggalin… wala n bang mas mahirap tanggalin….
anjparmisano said,
June 5, 2007 at 11:02 am
thanks chiefmeister!!! good job!
renzie said,
June 6, 2007 at 9:36 am
thanx poh maxado sa tutorial nyo!! ang galing nyo mga PINOY!!!! woohoo!!!
wala na ung TAGA LIPA ARE! sa IE ko and wala na ring lumalabas na FSG519.DLL.VBS pag nagdo-double click ako ng mga hdd ko.. thanx poh talaga
timothy23 said,
June 7, 2007 at 6:58 am
hi bakit po wala po akong makitang “FSG519.DLL.VBS and autorun.inif” dito sa hard drive ko?..
Ramesh said,
June 7, 2007 at 1:38 pm
Hi,
I tried deleting autorun.inf files from all the drives but I still have to right click on the drive and open..the autoplay option is still there.I dont have the files FSG519.DLL.VBS and…….in the registry.I formatted the drive and reinstalled the OS but I still have the autoplay for all drives..I got this issue since the time I installed AVG antivirus.. Can you help me
mtvyn said,
June 8, 2007 at 9:26 am
Question:
What if your usb mass storage device is affected with this virus and then plug the usb device on another clean computer would this affect the hard disk/softwares of the clean computer?
010110 said,
June 8, 2007 at 9:35 am
As for those who are still encountering the autoplay thing on your Hard disk drives
Erase- autorun.inf located inside the HDD and of course erase the fs6159.dll.vbs if its still there
if you have done this. restart the computer then ur done.
this was how i got to open my HDD once again
BMW said,
June 15, 2007 at 9:53 pm
Thanks for all this , i have the same problem but th autorun file is not seen even after showing what is hidden . The problem still with me
could any one tell me how to remove this disturbed trojan
THANX
unknown said,
June 17, 2007 at 3:14 am
ayos….pinoy nga naman…anyway…this is a wake up call to all you WINDOZE…users!!! Switch to UNIX and you’ll be happier…till the end of your days….I suggest you get OpenBSD! http://www.openbsd.org
to the creator, hmmm….i know you…
to bad that knowledge could have been more useful in the Unix Community…
Cheers!!!
unknown said,
June 17, 2007 at 3:20 am
to all….there is call for participation at the U.P. Diliman Interactive Center (DILC) for a scheduled Linux Professional Institute (LPI Level 1) Certification “www.lpi.org”exams…
i hope more filipino hackers and crackers who loved UNIX and kept pesking Windows will come in and join this bandwagon effect….
the more certified professionals we have the better we can educate the countrymen in using UNIX/LInux platforms in their day to day activities….
again, CHEERS….
unknown said,
June 17, 2007 at 3:22 am
ohhh…yeah the link…. http://www.lpi.org and do check dilc for schedules…
KAMPAI….
unknown said,
June 17, 2007 at 3:32 am
sa mga ta-ong nag engot engotan noon (Windows users) at Ulol na ngayun (Unix / Linux) users…. tama na ang pagamit ng mga software na di secure… of course the reality and philosophy of Windows and Unix are gravely against true design principles in Computer Science…beh… don’t know. Maybe you can google up for these books to help you enlighten your piece.. The Cathedral and the Bazaar — by : Eric S. Raymond and his other book : The Art of Unix Programming !!! both will materials contains the manifesting evidence of software evolution and people that drives it’s core…It exemplifies the ecosystem of both proprietary and OpenSource….
handog ko ito sa lahat ng nag babalak na gumawa ng un-ethical??? well…depende sigure sa uri ng pag-iisip mo…kung programmer ka studyante man o professional…. sige na re – orientation lang yan ng pag iisip para makamtan ang tamang layunin…
King said,
June 18, 2007 at 9:04 pm
Impressive indeed!!!
Nice job for the author of these kind of virus..
Galing mo pare/mare!! Hanga ako sayo.
ruel said,
June 25, 2007 at 12:57 am
Sir how about removing HELLO WORLD i am VB in IE?
arun said,
June 29, 2007 at 6:03 am
hello . this is arun , my system is geeting some problem .
the problem is when ever if click on the hardisk it will auto play , i want to remove that , how i have to do that ,
plz do the needfull
thanking you
SHADOW.SKILL404 said,
July 2, 2007 at 1:25 pm
-hi
To the creator of virus… I know gusto mo lang magpasikat… =) But keep up the good work… hehe…
SHADOW.SKILL404 said,
July 2, 2007 at 1:32 pm
s
UNKNOWN said,
July 7, 2007 at 12:09 pm
To the creator…
I think your so dumb!
You just insert some stupid batangueno strings into your code…
thats it,… nothing more… nothing less…
Di mo man lang tinago ang source code ….
NOOB!!!!
ivy said,
July 11, 2007 at 5:37 pm
thanks, that f***ing fs6519 drove me nuts. I thought i made a mistake on my searches..
hahaha.
Thank you so much. tis one helped me a lot.
KUDOS!
Roderick said,
July 12, 2007 at 8:35 am
Hi there,
I think you can help me solve this dilemma of mine, two of or office PC got infected by a boot virus that displays this dialog before it can boot up in windows.
Heres the dialog:
( I am still waiting for the strawberry coming from my baguio! Pls…Help! )
The RUN Command in the other PC is disabled and I cant get through some registry editing by manually deleting the virus script.
I already tried System32’s gpedit utility, but i still can’t restore RUN command
Thanks in advance and good day!
Rick
Roderick said,
July 12, 2007 at 8:42 am
Oppps, another one, one of my anti-virus has detected and deleted this virus FS6519.dll.vbs, but every time I double click to open my storage, it says that it can’t find FS6519.dll.vbs – my remnants pa ba tong virus na to?
Rick
josh said,
July 24, 2007 at 9:36 am
hey, i think that works but i can’t try that in my PC because the task manager, the registry editor, the system restore and the run command aren’t working eventhough haven’t done anything about it. can you help me? Windows says that my Administrator has disabled it. How come? Also, I cannot change my home page and it is set into “http://thecoolpics.net/” site. how is this?>>> thanks…..
josh said,
July 24, 2007 at 9:37 am
hey, i think that works but i can’t try that in my PC because the task manager, the registry editor, the system restore and the run command aren’t working eventhough I haven’t done anything about it. can you help me? Windows says that my Administrator has disabled it. How come? Also, I cannot change my home page and it is set into “http://thecoolpics.net/” site. how is this?>>> thanks…..
josh said,
July 24, 2007 at 9:39 am
Also, in addition, I can’t open the folder options because it is missing. Is there anybody knows how to bring it back???? please help….
Tamers, SImple Amazing..... said,
July 28, 2007 at 10:42 am
Use hijackthis, just search it through google mga pre……. hehehehehehehehhe
paranoid na ko! said,
July 31, 2007 at 2:13 am
I think i’ve already deleted the dll.vbs in all the hardrives i have even before i
found this site and follow all the steps needed to eliminate the virus..
but whenever i try to open my hardrives, it tells me that it cant find
the script file FS6519.dll.vbs…..
how’s that ?!!
pls pls pls . . .need sum help here.. (” ,
Godbless u all!
riza said,
August 1, 2007 at 5:14 pm
ei thnx for the info! I followed the steps until the regedit or edit part BUT there’s no search results for FS6519.dll.vbs and TAGA LIPA ARE!
Somehow i got rid of the virus and autoplay. I can even double-click my HDD.
BUT taga lipa are is still in my IE. How can i get rid of it?
jet lingin said,
August 2, 2007 at 1:37 pm
how will you delete the “i am still waiting for the strawberry from my baguio virus?” the steps above doesn’t work eh…
marlou said,
August 3, 2007 at 2:32 am
how to remove the virus the turn ur hdd drive into ascii character w/ autoplay?
Ranjit said,
August 6, 2007 at 10:27 pm
http://alexmaximo.com/2007/02/taga-lipa-are-removal-tool/
check out the link for removing this trojan
marvin said,
August 7, 2007 at 12:01 am
Hi to all people pls help about this, to how to remove this I am still waiting for the strawberry coming from my baguio! Pls…Help!
what anti virus can remove this I am still waiting for the strawberry coming from my baguio! Pls…Help!
please send to my email @marvcph2001@yahoo.com
tnx
marvin
Ace said,
August 8, 2007 at 7:01 am
Hi guys,
Please help me my PC is infected with virus, virus name is strawberry, pag open ko ng pc may window na lumalabas ang nakalagay “i’m still waiting for the strawberry coming in my baguio, please help,” at pag hindi ko na click yng OK na buttom hindi sya tutuloy sa windows, pano ba i remove ito, please! thanks ng marami, marami narin akong ginawang way eh wala talaga, pati sa registry nilinis ko na ganon parin,
Thanks,
Bongskee said,
August 8, 2007 at 3:47 pm
Hi!
I need you help guys… please send ne an email how to remove “i’m still waiting for the strawberry coming in my baguio, please help”
Tnx
quimz said,
August 9, 2007 at 6:04 am
i just stumble this website today….. in order to avoid this virus, spyware,adware thing.. be sure your antivirus is up to date… i really really recommend kaspersky anti virus.. it has a feature that it will block bad websites..
Also if your computer is already infected… just scan it or system restore it using ultimate boot cd..it has many tools to work around in your pc..btw. ultimate boot cd will run in the memory not on your hard disk
glennpanotes said,
August 10, 2007 at 11:49 am
pano po matatanggal ang autoplay sa mga harddrive,tsaka ung virus po na oragon ini.,hindi ko po tagala matanggal eh…thank po..pakireply po sa email ko..
ito po email ko….glennpanotes@yahoo.com
Marrion said,
August 17, 2007 at 2:51 am
thank you. it helps me alot…
Jay A. said,
August 17, 2007 at 11:36 am
huwwwaaaaaww… galing galing naman…
pero i have the same problem like h\josh does… hope you can help us guys!!!
hARdrain said,
August 19, 2007 at 12:23 pm
just can’t believe, though all of the methods has been proven right, nevertheless
you can just use the simple del command of dos just to delete the so-called so-weak trojan type “taga lipa are”. tsk tsk tsk… just use the /ah line options and no sweat.
naithan said,
August 22, 2007 at 7:07 am
i cannot delete the autorun.inf when i delete the autorun.inf still comes back and there is no FS6519.help me pls
raxso said,
August 24, 2007 at 6:20 am
Congratulations to all of you who already remove the virus/trojan to your PC as to those who wasn’t able to remove it you must be logged in as administrator of your PC before doing the procedure. as for the strawberry virus.. I’ve already posted the procedures on how to remove this…
Thanks to all you….
raxso said,
August 24, 2007 at 6:21 am
naithan,
you should look on all of your disk drive including usb in order to completely remove the virus.. and did you follow all the procedures…. try to check the procedures maybe you missed something.
Babes said,
August 24, 2007 at 7:45 am
Hi, My problem is same with the others re Strawberry Virus? Is there a removal tool for this just like the Noob_Killer_Juicer for Taga Lipa ARe! virus? Help! tnx
raxso said,
August 24, 2007 at 7:57 am
Hi babes,
I created a new how to of how to remove strawberry just click on this link.
http://raxso.wordpress.com/2007/08/22/how-to-remove-i-am-still-waiting-for-the-strawberry-coming-from-my-baguio/
hope this helps.
Babes said,
August 24, 2007 at 9:28 am
Hi,
I tried to use the NOOB_KILLER.Leerz in removing the taga Lipa ARE! virus from my PC and it really works! Thnx. Faster that editing the registry! I’ll try next time to remove the strawberry virus. Actually it’s in one of the branches PC which I saw yesterday, have to go back there next week to remove it, i’ll give updates later….till then… tnx, raxso!!!!!
Babes said,
August 24, 2007 at 9:31 am
Hi,
Will the NOOB_KILLER be effective in removing strawberry virus?
Babes said,
August 28, 2007 at 7:11 am
Hi, tried removing the strawberry virus but it keeps on coming back everytime I re-start the PC.. I tried just a while ago to remove it while in Safemode, hopefully it will never go back….
Windows Virus Found in Apple iMac Computer! « MirandaSoft! said,
August 29, 2007 at 8:47 am
[...] Raxso has a Tutorial on how to remove this virus. [...]
Alexis Pandaan said,
August 30, 2007 at 6:50 am
I hereby declare a global war against ‘taga lipa are’ virus.T’was not a joke for me.
the one said,
September 3, 2007 at 6:10 pm
hoy creator ng virus, di rin ako natutuwa sa gawa mo. gumawa ka ng something more productive tulad ng ikaauunlad ng pilipinas n pag nag clik mga foreigners yung mga pera nila pupunta s pilipinas. mas ok pa yun kesa s simpleng trik mo na yan. project b ng grade 1 yang ginawa mo?
dzgashvili said,
September 4, 2007 at 2:06 am
hey, anyone who knows how to remove RMD Rocks!!! virus? RMD Rocks is displayed in the IE title bar, and when you start-up your pc, a dialog box with a title of Mabuhay! and a message of Mabuhay ang Pilipinas! Mabuhay din ang Batangas, Marinduque, Romblon at si RVDJr!!! will pop out.
please help me with this one.. thanks
maydee said,
September 5, 2007 at 5:41 pm
hey guys, about sa taga lipa are virus, since galing sa USB ko un virus, siya muna uunahin ko tangalan ng virus then saka un hardrive ko nu?
dub said,
September 19, 2007 at 10:14 am
…yabang ng mga tanggalang yan ah, di nila alam nakakaperwisyo sila.
if ur thinkin ur big fish already for even cooking it up, i hope bigger fish out there stew ur pc for good.
be glad that biggies got better things to do than do kids stuff like this.
effin fag.
vena said,
September 25, 2007 at 7:17 am
no!!!!comment>>>
ina said,
September 28, 2007 at 3:10 am
when i double click my external hard drive it says Can not find script file “H:\FS6519.dll.vbs
mhac_2x said,
September 29, 2007 at 6:50 am
Nice Information. Not Bad….
J.Labagnoy said,
September 29, 2007 at 3:54 pm
For those who were able to follow the instructions above but were having problem(s) with the “AUTOPLAY” which is still the default when they click their drives, here is the simplest solution:
1. Run Task Manager (Ctrl-Alt-Del or right click on Taskbar)
2. Stop “wscript.exe” process if available by highlighting the process name and clicking “End Process”.
3. Then terminate explorer.exe process.
4. In Task Manager, click on File -> New Task (Run…).
5. Type “cmd” (without quotes) into the Open text box and click OK.
6. Type the following command one by one followed by hitting the Enter key:
del c:\autorun.* /f /s /q /a
del d:\autorun.* /f /s /q /a
del e:\autorun.* /f /s /q /a
c, d, e represent drive letters on Windows system. If there are more drives or partitions available, continue to command by simply changing to other drive letter(s). Note that you must also clean the autorun files from USB flash drive or portable hard disk as these external drives may also be infected.
Enjoy!
Recomended Security (Free Downloads):
1. Comodo Anti-Malware
2. AVG Free (Use Kaspersky or NOD32 if you got money to pay)
3. HijackThis
4. AVG Anti-Rootkit
Marie said,
October 3, 2007 at 10:01 am
How do I remove vbs virus found in system volume information folder? When I try to open says inaccessible.
jat said,
October 13, 2007 at 9:23 pm
mine says “cmd is not a valid win32 application.” what do i do?
elaine said,
November 4, 2007 at 3:08 am
does anyone know how to remove the virus RMD ROCKS!!! please help me..
anewnotsub said,
November 7, 2007 at 5:09 am
i have this problem with my pc… whenever i open my pc this message always appears: can’t find SSCVHOST.EXE …….. how can i remove this. ….
thnx…..
anewnotsub said,
November 7, 2007 at 5:10 am
what will i do when my run command at the start menu cant execute any dos command…
Angel B. Samaniego said,
November 11, 2007 at 8:23 pm
Dear Friends,
How do I get rid of the name ”oragon.ini” next to the time at the bottom taskbar of my screen and also appearing on the top of my IE? Para din siyang “Taga Lipa Are”, should I follow the same procedure on how to remove “Taga Lipa Are Virus”?
Please help me.
Your answer will be much appreciated
Best regards,
Angel B. Samaniego
Etihad Airways
Abu Dhabi, UAE
asamaniego@etihad.ae
dee said,
November 19, 2007 at 10:42 pm
ive been connecting my ericsson fone in my pc to transfer fotos and get mp3’s, will it my fone be affected?
dee said,
November 19, 2007 at 10:59 pm
oopsie..will my fone get the worm since iom connecting it to my pc and my pc has the taga lipa are worm already?if my worm is infected, how will i remove it?
Gatcho said,
November 25, 2007 at 10:16 am
Elaine:
“RMD rocks” can be removed by removing an entry in the registry …
start > run > type in: “regedit” (w/o the quotation marks)
go to: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
look for an entry called: window title … then delete it =)
Gatcho said,
November 25, 2007 at 11:26 am
bdway for that trick to work … dapat tanggal na yung virus. use AVG free … my NOD32 wasn’t able to detect the virus (that came in free with my Nintendo DS from greenhills lmao).
Noel said,
December 5, 2007 at 7:31 am
Good day!
I have problem with my pc, a message “Mabuhay ang Pilipinas, Batangas, Romblon, Marinduque at si RVD jr” pop up on the screen during start up. I tried some of the solutions posted here but it seems doesn’t work or may be it was me couldn’t follow. Is there somebody has an easier way fighting this thing. Many thanks….
Alvin Apolinario said,
December 6, 2007 at 8:38 am
Hello guys!! Try to use Kaspersky anti-virus. and I have a Noob keller here.. If you want it just email me.. apolinario_alvin@yahoo.com. this is a VB 6 program that design to remove the FS6519.dll.vbs
Alvin Apolinario said,
December 6, 2007 at 8:59 am
you can download also the file from : http://www.mediafire.com/?4txxxxdf22y
Denver said,
December 7, 2007 at 11:31 am
Mga co-Pinoys ko dito, ingat din kailangan talag natin these days…I think no matter how tight our PC security is or our offices may have multiple levels of network security, it does all boil down to the weakest link…USERS. That’s us. Today I just went through removing RMD ROCKS, TAGA LIPA ARE and Destrukto_Ako on our office desktops and laptops. These viruses travel fast through the help of mobile hard disks and USB memory. So mga kababayan, ingat na lang po! Sa mga kababayan ko namang pasaway, I do commend you for your skills, pro it would be better if makagawa kayo ng virus that targets corrupt politicians and super kotong cops na lang instead of people who everyday work for an honest living. Ciao!
mark said,
December 8, 2007 at 3:29 am
Please help me my computer block the setup of anything that i install….
Alvin Apolinario said,
December 12, 2007 at 9:53 am
Tama ka dyan pre!! kaya please lang!! mga kababayan nating pasaway ingat din..
ClusterMind said,
December 12, 2007 at 10:44 am
To the “WORM” author…
This is just an annoying script kiddie mushing stuff…. If I were going to create a worm, all files inside your USB Drives will be deleted..
That’s a real worm power… TTMS, LIPA, Jay.exe, etc…. “ALANG KWENTA YAN!”
majuro said,
December 14, 2007 at 1:45 am
if you don’t have too many programs in your pc just yet, i suggest you reformat, re-install all your programs and then install Deep Freeze 6 on your pc and freeze your C drive. DeepFreeze restores your system and files prior to the freeze everytime you restart your pc. that way, your programs get protected and no malicious programs can get into your windows folder and other system files.
it’s better if you partition your hard drive into C and D. leave the drive D unlocked so that you can save your work there.
you may also want to install kaspersky.
qwerº said,
December 26, 2007 at 10:49 am
hey guys!..I also have a problem with a message “Mabuhay ang Pilipinas, Batangas, Romblon, Marinduque at si RVD jr” pop up on the screen during start up. I tried some of the solutions posted here but it seems doesn’t work or may be it was me couldn’t follow. Is there somebody has an easier way fighting this thing. hope you can help me fix these shit.
qwerº said,
December 27, 2007 at 3:07 pm
hey guys i already removed the “taga lipa are” and “rmd rock”.. that noob_killer.leerz really works!.. thanks for the info.. but there is one more problem with my pc.. it is the “Mabuhay ang Pilipinas, Batangas, Romblon, Marinduque at si RVD jr” .. please help me on this.. tnx guys!..
Elmer said,
December 30, 2007 at 9:42 pm
I already did all what you guys said including the installation of COMODO but still I have this nuisance pop up at the start up which says “Mabuhay ang Pilipinas! Mabuhay din ang Batangas, Romblon, Marinduque at si RVD Jr.”
justine said,
January 18, 2008 at 7:43 am
sa mga creator ng virus..galingan nyo pa at baka sa susunod buhay nyo na ang my virus..hehehe..pag kau napatay mga creator magagamot ba kau ng anti virus nyo..hehehe..mga gago..marami ka napiperwisyo ng ginagawa nyo ahh..madali para mawala ang autonplay..
type lang sa run ang mmc.tpos turn off ung autoplay then restart compter..hehehe
Gene Ganda said,
January 26, 2008 at 9:14 am
hey guys, about the “Mabuhay ang Pilipinas! Mabuhay din ang Batangas, Romblon, Marinduque at si RVD Jr.” try searching the following files:
vbruntime32.dll.vbs
jay.exe
mveo.exe
if you found one of them, shift+delete all of the files with the name “jay” on it especially the above-mentioned. ~_^.
btw, try using kaspersky anti-virus, its the best anti-virus so far and at the same time use pc tools spyware doctor.
take care and God bless. ~_^
Geena said,
February 5, 2008 at 2:01 am
Hello,
I tried following the steps for removing the mabuhay angpilipinas pop up but to no avail. please help….thanks
Alvin Apolinario said,
February 5, 2008 at 10:25 am
I will try to upload my new ati-virus. It is effective to restore the taskmanager, folder option, msconfig and remove the new folder.exe file..
Jean31 said,
February 10, 2008 at 12:42 am
Hmmmp!!! … How awful Virus Creators you are guys… By the way… I also got “Mabuhay Pilipinas” virus… and I saw on one of the notepads some written words such as… “SHARAP” “Bagsak ako sa rizal” and “kilala nyo ga si pHogs at Adriel Justin?”… I used Trojan Remover and I succesfully deleted the virus… Now, my problem is.. The IE is still having that F***** words and the pop-ups is still appearing.. I cant also acces my task manager, registry, anti-viruses and other system apps.. … Its really annoying… you know… what should I do?
liaquat abbas said,
February 12, 2008 at 7:42 pm
i hv also the same problem what can i do.any one here to help me in removing the virus Mabhuhay din ang Batangas Marinduque, Romlon at Si RVDjr. it is appearing at the window start.
von said,
February 14, 2008 at 4:14 am
hi i wonder if u could help me out bout my little problem..i have a gud friend who was trying to fix my pc because of this strawberry thing but instead after rebooting it cannot log in anymore i mean if you log in it logs out automatically and comes back to the log in screen and if you log in again same thing will happen los in then out..what do you think?
Bolle said,
February 14, 2008 at 2:59 pm
Guys,
I had many laptops in my lab infected with the “TAGA LIPA REY” virus. The best method to remove it is,
1. Restart your system in “Safe mode”.
2. Disable “System Restore”
3. Run regedit and delete all the registries as aforementioned.
4. Go to Win32 folder in your C:/ and delete the files as mentioned in above posts.
Restart your unit and it should be gone.
raphy said,
February 19, 2008 at 7:23 am
paano bang mag tanngal ng strawberry virus if the task manager was automotically closed if you open it???
pwede bang pki post ung steps….
john said,
February 23, 2008 at 10:25 am
hey guys… usually nakukuha ung mga rmd rocks atsaka rvd na yan thru celfons and other removable device / storages… so be carefull next time, u can remove it thru regedit or thru ani-virus (like what they said…)
try to scan it first….
john said,
February 23, 2008 at 10:30 am
another thing is, do it in a safe mode like what BOLLE said (hehehehe)
or to be sure just do the BACK-UP and FORMAT thing…. hehehehe
SKETCH said,
March 3, 2008 at 5:05 pm
Try use firefox as ur web browser! Safer and better more add ons available. Sira ulo kc gumawa ng virus na yan walang magawang mabuti sa mundo kakarmahin din yan pc nya madadale. tnx man ! wordpress pala to Joomla kmi mga noypi because open source matters!
zeus said,
April 11, 2008 at 3:14 pm
man thanks alot!
Apple said,
April 21, 2008 at 12:04 pm
Hi, i was able to delete my “taga lipa are!” in IE bar, however may :F still has this annoying FS6519.dll.vbs. however i cannot delete in regedit coz it has been deleted already. My :C works fine now.
I tried the Startup in MS config, but i can’t find it there as well. Can you help me please?
thanks!
raxso said,
May 13, 2008 at 11:46 am
To All:
I have move my site and for more tips/tricks for windows xp and vista visit my new site..
http://raxso.net
you can also request for a tutorial or troubleshooting on my new site….
princeton said,
May 29, 2008 at 12:08 am
plssssssss help me my laptop have a TAGA LIPA ARE! i cant take it off pls plls pls HELP ME!!!!!
princeton said,
May 29, 2008 at 12:11 am
plssssssssss help
princeton said,
May 29, 2008 at 12:12 am
noob killer does kill viruses including taga lipa are!?
Rener said,
June 18, 2008 at 7:16 am
Use Tune up utilities in safe mode and remove it manually in your computer.. Formatting the flash drive will completely delete the virus.. or rather delete it manually in Tuneup utilities..
raxso said,
June 18, 2008 at 12:53 pm
@rener
Thanks for the comment, you can also check my new website at http://raxso.net
benj said,
July 30, 2008 at 1:02 am
how can i remove “batangas” dun po sa system time ko sa may system tray? naalis ko na po ung “twinz.exe” ok na din po ung registry ko. kaso po pag binunuksan ko ang excel files ko na may time sa bawat cells, nadadagdagan ng “batangas” sa bawat cell na merong time entry. pano po un?
Enriko kun’s » Blog Archive » Virus Talk “How to Remove “FS6519.dll.vbs” or If you Have “TAGA LIPA ARE!” in your IE” said,
September 8, 2008 at 2:45 am
[...] Click here [...]
sunday night organist said,
October 6, 2008 at 7:52 am
amf tae ka tae tae tae hayufffff
Leo_phi said,
November 7, 2008 at 8:19 am
i cannot open my drives C,D, when i double click it or ryt click+open,,, but when i do that the window with list of programs appear that making to choose to which program to use to view my drives,,
whenever i insert my flashdisk it always creates a “restore” folder, the size is around 1.44mb, if i format my drive, then insert it again,the same thing happens.
this is my first tym to encounter this kind of virus,,, i already encoutered taga-lipa-are and solved it,, but this one is different.,,i think..
allen said,
January 31, 2009 at 9:55 pm
bkt gnun lging nag dont send ang internet explorer pa elp nman dyan pwde need help
allen said,
January 31, 2009 at 9:57 pm
how to download avg
with coment
?????
lito said,
May 4, 2009 at 4:59 am
my computer was used by an internet cafe. i canot save my works done and all i want to download. when i turn off and turn on all i put or download gone. please help me.
Jun Bert Fabale said,
June 29, 2009 at 3:15 pm
elow sir oscar. . .mzta na po. . .balita ko cisco professional na u ngaun ah. . .hekhek. . .patulong nmn po ako sa cisco. . .