Removing Systime Virus

Author’s Comments:

• You must be comfortable with using command prompt, registry editor, system configuration utility.
• Most antivirus software is unable to detect the virus at the time of this post (21 Jul 2008).
• Note: Use this guide at your own risk, me and techbug.com shall not be held responsible for any problem caused to your system as this is my own personal method on how to remove the virus.

Symptons:

• You are unable to double click your thumb drive through “My Computer” or “Window Explorer”.
• You are unable to remove using “Safely remove USB Mass Storage Device” from system tray.

Solution:
End the systime process in Task Manager

1. Go to Task Manager.
2. Select systime.exe, click on End Process.



3. Click on Yes to proceed with End Process.

Remove the virus from thumb drive.

1. Locate the thumb drive letter from “Window Explorer“.
2. Click on Start -> Run -> type cmd, click on OK.  Command prompt will appear.
3. Now go to your thumb drive letter by typing in my example “I:” and hit Enter key.
4. Type “dir /a autorun.inf“.
5. Type “type autorun.inf“. (You should see the content of autorun.inf simliar to my screen capture.)



6. Type “dir /a autorun.inf“.
7. Type “attrib -a -s -h -r autorun.inf“.
8. Type “del autorun.inf“.
9. Type “dir /a autorun.inf“. (It should return you File Not Found, If you still see autorun.inf try repeat again from step 6.)



10. Type “dir /a systime.exe“.
11. Type “attrib -a -s -h -r systime.exe“.
12. Type “del systime.exe“.
13. Type “dir /a systime.exe“.

Author’s Comments:
Virus always create an entry in registry for itself to run automatically (aka startup) whenever it boot into windows. (The below screen capture is an example of systime virus being run automatically when the systime boot up) We will be deleting this entry via registry editor.

• Click on Start -> Run -> type “msconfig“.
• Under System Configuration Utility, click on Startup.  Look for systime.


Before removal of registry entry

After removal of registry entry

Remove all systime entry in registry editor

1. Click on Start -> Run -> type “regedit“.
2. Under Registry Editor, press Ctrl + F to bring up the search box.
3. Enter systime.exe in the search field.
4. Delete the parent key of o’en in my example “{848d316e-2e19-11dd-819a…} that where I find systime”.  (The parent key {848d316e-2e19-11dd-819a…} actually varies from system. you might have more than 1 key containing systime under MountPoints2)



5. After you have deleted the kay. Press F3 to continue searching.
6. It will bring to you “My Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run“.
7. Delete the string “System” with value “C:\Windows\System32\systime.exe”.



8. It will bring to you “My Computer\HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache”
9. Delete the string “C:\Windows\System32” with value “systime”.

Remove the virus from C:\Windows\System32

1. Click on Start -> Run -> type cmd, click on OK.  Command prompt will appear.
2. Now go to your C: drive letter by typing in my example “C:” and hit Enter key.
3. Type “cd \windows\system32” to go to C:\windows\system32 folder.
4. Type “dir /a systime.exe“.
5. Type “attrib -a -s -h -r systime.exe“.
6. Type “del systime.exe“.
7. Type “dir /a systime.exe“.
   (It should return you File Not Found, If you still see systime.exe try repeat again from step 12.)