Lord rahul cool virus

My Internet Explorer is infected with “lord rahul cool.” It shows on the title bar. Please advise on how to remove “lord rahul cool” virus on my laptop. Thanks

136 Responses

  1. harbans mahajan says:

    Dear Sir

    Our window exployer diffected with lord rahul cool virus plz send the solution. soon becouse our imporant data unscure.
    deepak mahajan
    9312478436

  2. manu shukla says:

    Dear Sir

    Our window exployer diffected with lord rahul cool virus plz send the solution. soon becouse our imporant data unscure.
    deepak mahajan

    09919411160

  3. B'bec says:

    LORD RAHUL COOL WASTED MY EIGHT HOURS. The solution came simple. Followed below steps:
    1. Click on Any folder.
    2. Click Tools – Folder Options – View – Hidden Files & Folders
    3. Mark Show hidden files and folders
    4. Unmark Hide extensions of Known file types
    5. Unmark Hide protected Operating system files (Recommended)
    6. First two files were seen on my flash drive : Rahul’svirusprotection.vbe & autorun.inf
    7. Click on the properties of both file and unmarked Read only.
    8. Clicked Apply & deleted both files.
    9. Searched for Rahul*.* on hard drives.
    10. Click on the properties file and unmarked Read only deleted the file.
    11. Now LORD RAHUL COOL is out of my browser.

  4. krishna says:

    i am not able to delete that file..it says its being used and to delete we have to close that program first…

  5. Tamil says:

    Hey coolll
    use this below freeware software to delete ur file
    filehippo.com/download_unlocker/

  6. Tamil says:

    hey don’t fear this is not a virus i think………
    do it now………

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value
    ********************

    Window Title : LORD RAHUL COOL ”’delete this value or change it.

  7. A.Joseph says:

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    Window title not change after editing

  8. namy says:

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    after doing all this the problem is still there

  9. kip says:

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    after doing all this the problem is still there

  10. Basil says:

    Hey!!
    i followed all the steps you gave me bt it dd’t work, plz can you find other solutions for this LORD RAHUL

  11. Bruno says:

    After doing all you adviced me still the problem exist

  12. Bruno Moshiro says:

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    Still the problem exist even if you repeat the process several times

  13. subash says:

    your all answer not workout

  14. Tamil says:

    ok friends cool i give another one …

    actually this is a VB script file and located in System32
    directory, first you delete this file from this location

    do it
    In Windows Explorer…. following this steps
    Tools — > Folder Options —> View(tab)
    check this one
    Show hidden Files and Folders …
    Uncheck this one
    Hide prorected operating system files (Recommended)

    Now you can view all system files and Hidden files into your drives….
    go to this system directory
    C:windowssystem32

    find this file one “Rahulsvirusprotection.vbe”
    and delete it…..then following the REGEDIT clear steps….it’s really very simple.

    if u can not found this file, please search word like *Rahul*.*

    if u can not delete this file, please search the software name like UNLOCKER 1.8.8 in google
    this small utility can delete this file very easily

    download here…..
    w w w dot filehippo dot com / download_unlocker/

    if this problem will persist don’t feel mail me jacobtn.tn at gmail dot com
    i can create a utility and send u …………….Thanks

  15. Tamil says:

    modify
    go to this system directory
    C:\windows\system32

  16. Dinesh says:

    Hi Tamil

    Your advice worked out for me to overcome this problem
    Thanks for your help
    Cheers
    Dinesh

  17. Tamil says:

    you r welcome Dinesh

  18. panneer selvam says:

    hai,=0A jacob……plzzzzzzzzzzzzzzzzzzzzzzzzz…help me..i cant…whatev=
    er you told everything i tried..in the registry editor also i tried…direc=
    tly i went there and changed the start page to http://www.google.com and i tried l=
    oading the page again the same issue.just tell me how to change the key val=
    ue there.there is no option called key value..what no i have to change the =
    key value..next thing i tried downloading the unlock 1.8.8. unlocked the fi=
    le from system 32 rahul file unlocked and deleted..again same issue..can yo=
    u give me some info about this virus,.how its getting affected..jacob plz j=
    acob..i cried because of this…plz plz ..i beg help me to resolve this iss=
    ue..my mobile no +919789650958….folder options also i tried..now i am usi=
    ng mozilla..in IE 6.0 i cant fix the issue..oh my god.i cant tolerate this =
    one.i have AVG …updated version its utter waste..otherwise any anti-spywa=
    re or mallware program able to resolve this issue..plz reply me as soon as
    possible…i am waiting infront my computer without fixing this issue i wo=
    nt go anywhere..i am refreshing my inbox and i am eagerly waiting for your =
    reply…or is there anyway to reinstall the ie alone…can you suggest me s=
    ome good anti-spyware software so that i will install that too in my system=
    ..really i cant do anything with this virus..simply i tapped out in this..i=
    e got affected but my mozilla is still working fine…its not affected…th=
    e biggest comedy is i formatted the system just before few hours..and it go=
    t affected by this…what a comedy…i dont know how my system alone gettin=
    g affected by new viruses..i cant understand these things…really if you c=
    ome up with the solution i will be really thankful to you..i tried searchin=
    g in google i cant find anything..i found only one solution given by you…=
    when this virus was found..and no blogs about this..only two links related =
    to this came in google. its not a famous virus or what..k i dont
    want to bore you more..i need a solution for this as soon as possible.. i =
    am waiting for your reply..if got succeed with the resolution..we will cele=
    brate this new year in a grand manner…k take care dude bye…=0A=0Athanks=
    and regards,=0Aselvam…..

  19. Sandeep says:

    Hi,
    By using Microsoft security essentials I’ve removed the “LORD RAHUL COOL” virus, and after that I’ve changed my home page and title by getting into “regedit”.Now, that virus has gone and still I’ve one problem, every time i log in into windows(Windows xp sp2) it is showing the below error message
    “Cannot find script file C:\Windows\System32\Rahul’svirusprotection.vbe”
    I’ve checked in startup it’s not there.
    and I’ve also checked these two files “Rahul’svirusprotection.vbe & autorun.inf”,they are not present in my “system32” folder.
    please tell me how to get rid of that error message…

  20. Siva says:

    After deleting the file “Rahulsvirusprotection.vbe” using unlocker 1.8.8 and following the regedit steps. There is no problem in opening page of internet exploler. but while restarting the system a command come telling the host script file cannot be found.

    Pls reply if anybody knows how to tackle it.

  21. Tamil says:

    Siva tell me the exacting errors….
    do you know about the Startup items in Windows.
    check this first…

  22. S SENTHILKUMAR says:

    my laptop is infected by lord rahul cool virus,
    kindly help me to remove this virus and send procedure

  23. Sandeep says:

    Hi siva, I’ve found the solution for your problem.
    If the error message is
    “Cannot find script file C:\Windows\System32\Rahul’svirusprotection.vbe”.
    Create a new notepad document and open it, Don’t type any thing in it, leave it empty and save it as “Rahul’svirusprotection.vbe”.Then place this script file in “C:\Windows\System32\” and restart your PC, your error will be gone…

  24. Guru says:

    The “Quick Heal” antivirus software cleans this virus.

  25. Tamil says:

    i didn’t see ur brief explanation .Mr Paneer selvam ………sorry for late reply because i called ur mob number but u didn’t give any respond me….

    it’s not a virus ,harmless. i really saw it’s orginal source code.it’s a vb script file. Please refer 14 th message inthis forum..

    Hello Mr Siva……..

    please go to this REGISTRY KEY, edit the keyvalue
    for windows host error messages.
    HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Win­dows NT\CurrentVersion\Winlogon
    and find the key like ….”Userinit”
    edit this value ……..
    “C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”

    to
    “c:\windows\system32\userinit.exe”

  26. Tamil says:

    i didn’t see ur brief explanation .Mr Paneer selvam ………sorry for late reply because i called ur mob number but u didn’t give any respond me….

    it’s not a virus ,harmless. i really saw it’s orginal source code.it’s a vb script file. Please refer 14 th message inthis forum..

    Hello Mr Siva and Sandeep……..

    please go to this REGISTRY KEY, edit the keyvalue
    for windows host error messages.
    HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Win­dows NT\CurrentVersion\Winlogon
    and find the key like ….”Userinit”
    edit this value ……..
    “C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”

    to
    “c:\windows\system32\userinit.exe”

  27. panneer selvam says:

    actually tamil resloved my issue..after deleting the virus in the logon you will receive the message cannot run the script like that..follow this procedure…start–>run–>regedit..and go to the following path.. i will give you…heykey_local machine–>software–>microsoft–>windows NT–>current version–>windows logon…go there and delete the second path..thats for rahul cool virus..keep the first one alone and delete the rest..for ex:keep like C:WINDOWSsystem32userinit.exe..save then exit..thats all..next time it wont show the message

  28. Kashyap_128 says:

    krishna
    December 15th, 2009 at 4:37 pm 4

    i am not able to delete that file..it says its being used and to delete we have to close that program first…
    ____________________________________________

    open taskmanager, then END PROCESS of file named wscript.exe. Then, try to delete the file

  29. Kashyap_128 says:

    LORD RAHUL COOL^the troublesome jackass file^
    1. Open TaskManager
    2. Then click END PROCESS of file named wscript.exe.
    3. Go to C:/Windows/System32/
    4. You’ll find a file named Rahul’svirusprotection.vbe which I think is a Visual Basic file.
    5. Then delete the file “Rahul’svirusprotection.vbe”.
    The Problem of auto-opening of ZOOMSHARE Website and problem of jackass LORD RAHUL COOL will be over… :)

  30. Vidhyadharan says:

    Tamil u rock man..Thanks alot man… your solution really solved this problem.. F**K LordRahulcool

  31. john says:

    my browser shows LORD RAHUL COOL at the top..i followed steps advised by Tamil..but i cudn’t find Rahulsvirusprotection.vbe” or *Rahul*.* in my wondows/system32..plzzzzzzzzz tell me how to resolve it???

  32. john says:

    my browser shows LORD RAHUL COOL at the top..i followed steps advised by Tamil..but i cudn’t find Rahulsvirusprotection.vbe” or *Rahul*.* in my wondows/system32..plzzzzzzzzz tell me how to resolve it???

  33. joseph says:

    Thanks for your suggestions… i ve deleted that virus but still when i log on to my system it shows ” cannot find script file “windows\system32\rahulsvirusprotection.vbe” I cant guess actually what the problem this…

  34. Arun says:

    Pls take a look at it, I had the problem too and got it fixed from netcat Location: madras, south, India . His explanation follows:

    One of the most famous worms which attained star status during 2000 was the ILOVEYOU worm. It was followed by many variations of the same, but not deadly as the original. Indeed it was a surprise worm to the world, wrapping itself as a simple love letter text file. The ILOVEYOU worm spreads through emails using the Microsoft outlook mail software.
    Next came the netlog worm or Network.vbs, which infects the Microsoft operating systems. This worm spreads through windows file shares instead of emails. It can easily spread to the entire network connected with the file share. Just searching and deleting Network.vbs file in the computer can remove this kind of worm since it wasn’t that much intelligent.
    Here I’m going to disassemble a similar type of worm which spreads itself through USB pen drives. It has got many variants like “lord rahul cool” or boot.vbs, sys.vbs, VirusRemoval.vbs and Semiantivirus.vbs. Actually it’s my first hand experience with this worm which affected one my colleague’s PC that prompted me to write this article.
    The attack:
    One fine day some of my colleagues complained that some sort of virus has attacked their system which pops up messages when they open the internet explorer browser. I tried to find out what they did in common. They didn’t install any new software, or didn’t access any network share nor did they download any new exe program. But they were all listening to the same music!
    As we used to share mp3’s and movies in our office, it’s quite usual that we use pen drives for transferring the files. And one of these could have infected their system.
    Work lifecycle:
    It starts of as soon as the USB pen drive is plugged in. The Autorun.inf file in the pen drive loads our worm script which is hidden in the pen drive itself. The Autorun.inf file has a similar entry like:
    [autorun]
    open=hiddenscript.vbs
    icon=autorun.ico
    Since the Visual basic script can access the file system and windows registry these worms do alter the files/registry values according to their author’s purpose. They copy themselves to the windows system32 folder and make them hidden in windows explorer by modifying the registry value at:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue
    This worm has got the following characteristics:
    * Changes the internet explorer window title to the author’s own statement like “LORD RAHUL COOL”. This is done by editing the registry at HKCU\Software\Microsoft\Internet Explorer\Main\Window Title
    * Changes the internet explorer startup page to their own by editing the value at HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
    * Also modifies the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit registry value to launch the vbs script on windows login by calling wscript.exe.
    * These modifications are done even if we try to alter it manually, since it is programmed to repeat the same action every 1 second.
    Removal:
    At first I thought removal was quite easy. So I just terminated the wscript.exe which runs the script from the task manager and then tried to look for the vbs script but couldn’t find it. But once the system was restarted the worm came back in action. This time I spotted all the registry keys and removed them and then terminated the wscript.exe. But still the worm was inside. Then after learning about the visual basic script worms I found it that they can exist with vbe extension. So I searched for them and found them hidden inside the windows folder.
    Now I first stopped the wscript and next trashed the vbe file and then altered all the registry values back to normal. Now I restarted the system and it was all gone.
    One thing I’d not like to forget mentioning is to trash the vbe file in the pen drive and edit or remove the autorun.inf in the usb pen drive. After all that’s the source of trouble!
    Follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del.
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

  35. Arun says:

    Follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del.
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

  36. Arun says:

    Dont forget to turn on wscript.exe after the removal.

  37. janani says:

    hi i’m jenny…i deleted d rahul virus protection frm d system32 by using d unlocker but still it is showing on d top of my webpage…pls help me ppl….

  38. janani says:

    hi now i changed my web page but still it is showing lord rahul cool on d top of the page

  39. santhosh says:

    Hi friends,

    After doing this when i start my system it’s showing popup like this

    con not find script file “C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”.

  40. anand says:

    Hi , Can someone reply for the error after booting the system I am getting

    “con not find script file “C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”.

  41. janani says:

    ya d same prob for me too pls help us guys

  42. anand says:

    Did anyone try the below option ?after deleting the virus in the logon you will receive the message cannot run the script like that..follow this procedure…start–>run–>regedit..and go to the following path.. i will give you…heykey_local machine–>software–>microsoft–>windows NT–>current version–>windows logon…go there and delete the second path..thats for rahul cool virus..keep the first one alone and delete the rest..for ex:keep like C:WINDOWSsystem32userinit.exe..save then exit..thats all..next time it wont show the message

  43. janani says:

    thanks a lot ppl…..

  44. Prem says:

    Dear Friends,
    I removed rahul c(P)ool Virus.But i could not turn on wscript.exe

    rahul and autorun.inf files deleted but title bar showing the same.
    Please rectify my problem Friends.

  45. Prem says:

    Thanks a lot friends .That Bull S==t program has been removed.
    Then kindly help to protect my pc free of charge with free programs.kindly refer some good program names like malware and virus scan and adware and spyware remover

    mail me please
    sjsurya03 a t gmail dot c o m

  46. Jacob says:

    hello Friends don’t fear about this virus it’s really harmless ….this is Tamil…i already post more msgs to solve this problem…and i create a small Lord rahul virus removal utility with Vb.net and upload google groups with source code if any want to this utilty go to this page
    ……(bs = Back Slash, dot = .)
    http:bsbs
    groups dot google dot co.in bs group bs remove-lord-rahul-cool bs files?hl=en&upload=1

  47. r.prasad says:

    how to remove lord rahul cool virus

  48. Pc says:

    send me your mail id’s i will send the LORD RAHUL COOL removable utility…
    if u know VB.net also i willl send the Source code tooo..
    pc8181 at gmail dot com

  49. thalapathi says:

    search “Lord Rahul” in google groups……………

    groups dot google dot com

  50. sudharsan says:

    I couldn’t find rahul’svirusprotection.vbe and autorun.inf files, since my anti-virus software deleted those files
    Even then i’m facing the same problem

    I’m seeing “LORD RAHUL COOL” in the title bar of IE

  51. Senthil says:

    Hello panneer selvam,
    I did all the procedure in your post. Now its showing “there is no script engine for file extension.exe ” when i start my system. can u(or)any one fix this?

  52. Senthil says:

    tamil can u fix my problem?

  53. anny says:

    wats up!!!!

    still this rahul killing me a lot tried all the way but no solution, the bad luck i can’t go to regedit if i go to regedit it takes me to notepad where i cant read the contents there dont know may be chainees
    pls any more help plsssssssssss.

    annynkya at gmail dot com

  54. Prabhash Paudel says:

    I have removed the virus LORD RAHUL COOL but it still appears on the top of internate explorer.So please give me idea to chante LORH RAHUL in to internate explorer.

  55. Dhan says:

    Thanks friends, this is really helpfull and it works fine..kudoos to all for your efforts

  56. gaja says:

    Lord rahuls cool virus can remove by MCAfee antivirus. you can try & tell me.

  57. im4mmars says:

    Hey Guys, Please contact the author of this virus @ 9841414060. It is mentioned in the Rahulvirusprotection.vbe file. Check yourselves

    z

  58. Arul says:

    Thanks guy, I the solution given worked prefectly. Disable wscript.exe thru the task manager,Removed .vbe file from the system32 directory, and removed it thru regedit as mention above. Keep rocking guys..

  59. akila says:

    tamil man you rock or what…
    it was very kind of you helping us with all the steps..
    that virus was a pain.. i tell you i had almost a coupla hours of panic!!
    thanks man!!

  60. muthu says:

    hello sir,
    I have successfully the the lord rahul file.
    Even though the file has been deleted whenever I use pendrive it should be appear on pc.how to resolve this problem..

    [autorun]
    open=wscript.exe Rahul’sVirusprotection.vbe
    icon=%systemroot%\System32\SHELL32.dll,8
    action=Open folder to view files
    shell\open=Open
    shell\open\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Auto=AutoPlay
    shell\Auto\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Explore\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Find=Search…
    shell\Find\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Format…=Format…
    shell\Format…\Command=wscript.exe Rahul’sVirusprotection.vbe

    this message should appear in pen drive’s auto run file…

  61. Tamil says:

    Hello Muthu….
    please try Kaspersky 2010 Internet Security…

    welcome akila ….

  62. maatu says:

    let me know how to remove lord rahul cool spreaded in all the clients within a LAN. i tried to remove in one computer but it return again. i tried to remove in another computer with the same method using run-regedit etc butit was not seen
    help me on how to remove this virus spreaded in a LAN

  63. bhubal says:

    hi, Tamil,
    it really worked well in Mozilla also.thanks a lot.
    bhubal

  64. Ramesh Thapa says:

    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.
    Ramesh Thapa ( Nepal)

  65. nandhini says:

    hi tamil…
    you really rock man!!! thank you so much.. i removed tat LORD RAHUL COOL virus following ur instructions…thank u so much.. its really sweet of you helping us.. thank you!!!

  66. Raj says:

    hi Nandhini:
    Thanks for ur nice msgs….n you r welcome…!it’s really encouraged me….

  67. sivakumar says:

    when i start window , window/system32/rahuls virusprotection.vbe is not found is comes……… how to remove this from my system can anybody help me please…

  68. jack says:

    Its really working as tamil suggested.Rahulsvirusprotection.vbe will be avl in C:windowssystem32. If U cant delete it first download and install unlocker software from filehippo.com/download_unlocker. then select the file and rightclick and select unlock. Then press unlock all.Now delete rahulvirus file.
    for changing internet explorer title:
    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto HKEY_CURRENT_USERSOFTWAREMICROSOFTINTERNET EXPLORERMAIN
    here modify window title to Internet explorer instead of LORD RAHUL COOL.THATS ALL. ONCE AGAIN THANKS Mr.TAMIL

    to find & delete this rahul virus in pen drive follow as B’bec suggests.

  69. Tamil says:

    Verty simple steps to Remove Lord Rahul Cool
    ********************************************

    Virus Name : “Rahul’sVirusprotection.vbe”
    Format Type : Vb Script(visualbasic)
    File Size : 18.47 Kb
    Location : System directory (C-windows-system32- Rahul’sVirusprotection.vbe)

    Find:
    1) Internet Explorer window title bar name changed like : LORD RAHUL COOL
    2) internet Explorer Startup page is “http:–www.nyd.zoomshare.com”
    3) Wscript.exe process running

    Affect:
    change the registry keys and spread one to another system

    Remove:
    1) In Windows Explorer
    Tools — Folder Options —View
    Show hidden files and folders —-check this one
    Hide prorected operation system file(Recommended) —Uncheck this one

    2) GO TO System Directoty ex: (C:–windows— system32)

    find this file “Rahul’sVirusprotection.vbe” and delete this one, if u can’t do that following the below steps

    1)open the TaskManager(press control+Shift+Escapte key) in process Tab find ths Process “wscript.exe” and delete this one
    or
    2) using Unlocker 1.8.8.exe (search in Google site) for delete this file

    3) Type Regedit.exe into RUN Command
    HKEY_CURRENT_USER – SOFTWARE – MICROSOFT – INTERNET EXPLORER – MAIN
    Window Title = “”
    Start Page = “www.google.com”
    HKEY_LOCAL_MACHINE – SOFTWARE – MICROSOFT – Windows NT – CurrentVersion -Winlogon
    Userninit = “C:WINDOWSsystem32userinit.exe”

    Tamil…….

  70. arunkumar says:

    In system32 folder I cant find the file Rahul’sVirusprotection.vbe.. But I have this problem.. I have tried all the ways to find the file there but I could not find the file in system32 folder.. How can I find that file in that folder? Firstly I have to find that file to delete it..

  71. arunkumar says:

    Finally I found that file.. Thanks for the tips tamil.. Now the problem is solved..

  72. arunkumar says:

    Finally I found that file and deleted.. Thanks for the tips tamil..

  73. pparam says:

    im not able to see the folder options in tools and is there any other way to resolve this virus??

  74. Tamil says:

    Hi Pparam ur registry has more problems i think,bcz some viruses delete the FolderOptions Registry keys, so ur pc more than one Viruses i think.Please check your system with good Anti virus program.

    it’s k i give the solutions to You….
    ————————————-
    In Run command Type GPEDIT.MSC. now you can view the windows GROUP POLICY EDITOR.

    GOTO this Keys properly(Left pane Side:….)
    —————————-
    USER CONFIGURATION
    ADMINISTRATIVE TEMPLATES
    WINDOWS COMPONENTS
    WINDOWS EXPLORER

    now right pane side (it’s are important values for Explorer)
    ————————————————————
    double click this option
    REMOVES THE FOLDER OPTIONS MENU ITEM FROM THE TOOLS MENU

    changed to “NOT CONFIGURED”
    if “ENABLED” then the FolderOptions must be hide, so please choose the “NOT CONFIGURED” option. Then open the Explorer window now you can
    view the FOLDEROPTIONS menu…

    Thanks to READ
    TAMIL

  75. SUBRAT says:

    Hi, Tamil,
    I am Subrat.Still a am not remove that virus from my laptop plz. advice me.Only i remove the title bar name from internet explorer\main .I amnot found the virus file.When i log in laptop the same msg. is displayed c:\windows\system32\Rahul’sVirusProtection.vbe..Plz. tell me that solution.

  76. Janani says:

    Thanks a lot Mr. Tamil :) its really working out..
    Once again thanks a lot :)

  77. Janani says:

    When i plug my pendrive or ipod to my lap, its shows autorun.inf . is this the virus ? and also am not able to reject the flash drive properly.. Kindy help me

  78. MDU says:

    you r welcome Miss.janani …all autorun.inf files are not a virus.
    please mail me that files, i must help you.
    jacobtndotin at gmail dot com
    please install any one advanced Internet Security software like
    Kaspersky IS , Avg IS, Norton IS…..ur lap will be safe.
    i am using KVP IS 2010. it’s really worth.
    Thanks Janani…
    Tamil.

  79. Thiagarajan says:

    Good job tamil!

  80. S.K.Thambi Thurai says:

    guyz i can’t remove tht f***ing virus… pls help me out.. !

    when i open my browser it automatically goes to zoomshare website.. pls help me out..

  81. S.K.Thambi Thurai says:

    i have kaspersky 2010.. still it cant remove it.. the prob is still persisting

  82. panagudi genius says:

    hi janani,
    No need to send mail and all.just download the software name autorun eater..and install it..just scan your system using that software.and fix it..thats all..its 2 min work.that software size is only 1.33mb only..just try it..if you have any issues..update here i will resolve

  83. Sagar says:

    yes he resolved all problems.because he is Panagudi Genius.

  84. sandy says:

    thank u tamil.now my prob ill be solved..
    keep it up

  85. Visalakshi says:

    I am able to delete the lord rahul cool virus file from system32 file.. But unable to delete the name displayed on my internet homepage title bar. I tried entering the regedit option and by mistake i deleted the key called Start Page from HKEY_Local_MachineSoftwareMicrosoftIEMain. Pls guide me how to recover that key and how to get rid of this virus from my title bar……

  86. Tamil says:

    Hello Visalakshi
    do that steps

    Open a Notepad editor.
    copy this below values and save with extension .reg
    for example “Visalakshi.reg”
    then double click this file.
    you can restore that values.

    Windows Registry Editor Version 5.00
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    “Start Page”=”www.google.com”

    jacobtn.in at gmail dot com.

  87. karthiga says:

    whenever i click on my thumbdrive, it doesn’t let me access it and it says: ‘can not find script file “H:\Rahul’sVirusprotection.vbe’

    and i also can’t see my folders, when i try it on a differnt laptop i can see them as hidden files, what should i do? is this rahul thing a virus?

  88. AnNiHiLaToR says:

    Hi
    Don’t worry people it doesn’t do any harm, just looks like a prank.
    Here is a way to remove it. Its quite simple.

    It uses a process called “wscript.exe” so go to task manager and end the process (Processes tab -> Click on Process name “wscript.exe” -> Click on “End Process”)

    Now look for the 2 files “Rahul’sVirusprotection.vbe” and Autoplay.ini in your flash drive.
    Go to properties of these files and revome “Read Only”. Then Shift Delete.
    “Rahul’sVirusprotection.vbe” will also be present in your C:\WINDOWS\system32 so remove read only and delete from there as well.
    search for the file and delete in found anywhere else.

    Hope that helps.

  89. Tamil says:

    download and try it.
    Autorun Virus Remover V2.3(Jan 06, 2010)
    Autorun Eater 2.4

  90. M.Abdoul Bazid says:

    thank you very very much Kashyap_128

  91. Deva says:

    thank u Mr.Tamil you are a Rock man.

  92. Visalakshi says:

    Hi Tamil,

    Each and every time when I login my System, the clock timings are getting changed.. So each n every time I need to adjust the timings.. It shows the 2006 year calendar and timings.. Pls help me to have a proper and a correct timings when I log in..

  93. Tamil says:

    hi visa
    First find this Tnuzmtmi.dll file in ur system root directory.
    if it’s not please check ur Bios Battery.

    *****Tamil

  94. Prabha says:

    Tamil,

    Thank you very much….your solution works for me too ….
    Thanks once again

    Prabhakaran

  95. Tamil says:

    you are welcome Mr Prabhakaran.

  96. raghav says:

    b’becs answer is very very very good and pacca

  97. Krish says:

    hi Iam krish here too help u around… i have the same vrus in my system…here is the idea to remove it completely from ur system

    dont use any software its is a core removal idea….

    start > restart > press F8 for safe mode. LOGIN to ur system in safe mode.

    Then Open RUN > %COMSPEC%

    u ll get an Dos prompt in system32 DIR.

    C:\WINDOWS\system32>

    type DIR/ah

    C:\WINDOWS\system32>DIR/ah

    >it ll show u an list..

    becareful thats ur system basic files… in that u can find the
    Rahul’s antivirus protection.vbe file

    at this time open ur system task manager ALT+CTRL+DEL at ur desktop

    click PROCESS

    in that u ll find an image name called “wmscript” like that

    just right click on it and click end process tree.

    Now back to dos.

    >after that list.

    Type “DEL /a:h Rahul’s antivus protection.vbe”

    this will be full command

    C:\WINDOWS\system32>DEL /a:h Rahul’s antivus protection.vbe

    den find for other files like “sys drv_.dat” Sys_drv.dat… like that..

    all .manifest files are SYSTEM FILES BEWARE DON’T DELETE IT

    Also DLLCACHE is system file… thatssol…. he is out of ur system….

    now at ur next restart it ll show u that could not load the script

    Rahul’s virus protection.vbe.

    hxxp://free.antivirus.com/hijackthis/

    just install this software… run a scan beware after scan it ll show 2 files of the RAHUL’s antivirus protection in the scanned list… as a issue just click that checkbox and clear issue… thatsol..

    dont check other box this software may damage ur other softwares if u click other checkbox…..

    Krish

  98. asif says:

    hello tamil
    can avg,kaspersky remove rahul cooool?

  99. Yes says:

    hello asif
    Kaspersky removed this Virus
    but im not check with AVG….
    Tamil.

  100. asif says:

    what about esset nod 32?

  101. RONILITO MURILLO says:

    how to solve my problem.

  102. Swetha says:

    Krish it’s too much step it’s already resolved by some other with simple steps.

  103. Clinton says:

    Hey guys unlocker is not required. Just open task manager and end wscript.exe
    To open task manager ctrl+alt+del
    After ending that you can easy delete rahul’svirusprotection.vbe from system 32

  104. Bomvau says:

    How to I remove the dialog box which shows at startup reading “Cannot find RahulProtection.vbe”

  105. dino says:

    Follow this very simple..it removed rahul cool from IE

    thanks to Ramesh Thapa

    Ramesh Thapa said:

    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.
    Ramesh Thapa ( Nepal)

  106. murali says:

    dino and Ramesh Thapa(Nepal) both id’s are same guy..hhehhehehehe

  107. chrome says:

    Thanks Ramesh.
    Worked fine

  108. Mishba says:

    what worked fine mr.Chrome….

  109. virender says:

    This is cool stuff. I tried

    dino said:
    Follow this very simple..it removed rahul cool from IE
    thanks to Ramesh Thapa
    Ramesh Thapa said:
    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.

    This works.
    Thanks

  110. virender says:

    Well i had to apply the following steps to kill the virus names rahul.

    Just open task manager and end wscript.exe
    To open task manager ctrl+alt+del
    After ending that you can easy delete rahul’svirusprotection.vbe from system 32

  111. shinto says:

    well done ramesh thapa
    i have successfully removed lord rahul from mysystem i followed ur steps thank u

  112. Suga says:

    hello tamil can u tell me about computer management i wana reset my explore default settings …..thanks for removable utility for this virus. well done job once again thanks a lot………

  113. naafia says:

    my pen drive is with rahul antivirus protection.vbe i cant open my files which i stored in it… they are very important… please send me a solution to overcome this…

  114. Problemchild says:

    One more in c:/windows/system32. you need to delete 2 files:
    wscript
    nwscript

    Then go to regedit, click on search and put the value as Rahul, where u find the value name rahul just change the value to 0 or 1. DONT DELETE. click on F3 to find next…

    -Problemchild

  115. Vinod.S says:

    Thanks what
    “”””#13 on 18 December 2009 at 2:34 pm Tamil said:”””””

    was perfectly correct i just downloaded that software & got deleted that Rahul virus now working safely.

    Thanks Tamil.!!

    bye

  116. Guru PrasaD says:

    Hey guys…..i followed the steps below and finally got that crap outta my system!!!

    This was all i did in my computer…

    Ensure you hav the Administrator privelege before you start
    1.Hit the ‘F3’ button and search for ‘Rahul’svirusprotection.vbe’…
    2.Be sure to check “Search System Folders” and “Search hidden files and folders”…
    3.Search in “C:”…
    4.Delete the file that u get…it will be named ‘Rahul’svirusprotection.vbe’

    Then follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del
    (you may not even find the file coz u already deleted it in the previous steps)
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

    And please go to this REGISTRY KEY, edit the keyvalue
    for windows host error messages.
    HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Win­dows NT\CurrentVersion\Winlogon
    and find the key like ….”Userinit”
    edit this value ……..
    “C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”

    to
    “c:\windows\system32\userinit.exe”

    That’s all you hav to do…. :D
    Hav fun folks :D

  117. Jeevs says:

    Hi Tamil,

    you are rocking man.Thanks a lot for your tips to remove the virus.Can i get your mailid.

  118. jeevs says:

    Anyone help me to solve this problem.if i restart the system i receive
    the following message.
    “C:\windows\system32\Rahul’svirusprotection.vbe” could not be found.

  119. Robin says:

    i Used Bitdefender antivirus it removed

  120. annamalai (Sun Computers) says:

    This problem very simple download kaspersky internet security 2010 to activate trial license to update up to date clean rahu virus

  121. Madurai Tamil says:

    Jeevs said:
    Hi Tamil,
    you are rocking man.Thanks a lot for your tips to remove the virus.Can i get your mailid.
    ‘************************************

    Hello Jeevs., Thanks for your comment
    my mail id is Jacobtn[dot]in[at]gmail[dot]com.
    i m from madurai in TamilNadu.

    and welcome mr.Vinod.S

  122. anti rahul virus cool says:

    start ur computer…..press F8……login in safe mode…..run regedit….in view option go for

    “find”…..type “rahul”….u’ll find a parameter with rahul……just delete it….restart ur

    pc….go in normal mode…..go to start…run…type “regedit”……in view option select

    “find”…..type “rahul”…..delete the parameter u find in there named rahul..now u removed

    that virus i bet…enjoy dude.

  123. shrishti says:

    thank you your answers solved my problem. I like this website thank you

  124. vipin narula says:

    Dear sir

    I have an error message in my system “there is no script engine for file extension .vbe ”

    Please suggest me that how can i remove this message.

    Thanks & Regards

    Vipin Narula
    9888069980

  125. ameya says:

    Plz tel me how to remove lord rahul cool virus from my laptop?

  126. Ravi says:

    Dear sir,
    Beacuse of load rahul cool virus my computer pointer is unable to move please send me a solution to it. I am from rural area.

  127. Arun,karungal,nagercoil,tamilnadu,india says:

    Open notepad.dont type anything in notepad and save this file as Rahulvirusprotection.vbe in directory c:windows/system32.then restart the computer.thats all.

  128. Suria Prakash says:

    First
    Open task manager and kill process wscript.exe.

    Then
    Delete VirusRemoval.vbs and Autorun.inf files from all usb drives if u have the virus in them.

    Then
    Go to c:\Windows\System32 and delete the file VirusRemoval.vbs. It is super hidden so first go to Folder Options and check show hidden and check boxes. Also required for the above files.

    Then
    go to start>run and type regedit and enter
    Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    On the right side look for Shell which should have value of just explorer.exe.
    delete anything at right side of explorer.exe if there is anything.

    Under same key Winlogon also look for Userinit which should have value of
    c:\WINDOWS\system32\userinit.exe,
    Delete all the **** after the comma.

    Then
    Go to HKCU\Software\Microsoft\Internet Explorer\Main
    On the right side locate Window Title and delete its value i.e. Sujin.com.np

  129. Balasubramanian says:

    hi friends,I here asking you some tips as i follow the issue in my computer.Just
    start==controlpanel==maintainance and performance==seealso===system restore===set your system OS the earlier day of your system infected by this virus.It delete the virus and also installed .exe programs from that particular date and you have to lost some datas which is the .exe files only.System restore has not delete all saved and save as files.
    I solved this same issue and deleted the virus without make any changes.I think this is the only solution to understand easily.Try to follow this simple way.

    -Bala

  130. Jame says:

    Thanks a Lot.

  131. Livingston says:

    Hi Friends, i am livingston from chennai. I lost all my important documents as because of the Rahul virus in my pen drive. i dont know how to remove it. when i check for the space in my pen drive it shows 7.5 gb filled out of 8gb. but when open my pen drive it shows only a single folder called windows and four files called autorun.inf, boot.ini, NTDETECT.COM, ntldr. Can anyone call me and guide in this regards. Please…. please…. please……………. just give me a missed call. thats enough. i will call u. i dont have system in my house. i have to go to netcafe to rid off this virus from my pen drive. so plz call me and help me friends… if u dont want to call atleast mail me with the details. Thanks in advance. Plsssssssssssssssssssssssssssssssssssssssssss. My mobile number – 90800 17151.

  132. krishna says:

    Norton antivirus will fix it

  133. gayathri says:

    its so simple dude,..
    go to run command
    type “regedit”
    you will be displayed with the registry editor
    press ctrl+f
    in the file text box enter rahul’svirusprotection.vbe
    you will get the results
    right click on that file and and select delete
    the operating system will warn
    but just go ahead and enjoy!!!!!

  134. jino says:

    Hi Friends,
    One of the easy way to remove this virus is run one small software. The name is TREND MICRO HIJACKTHIS V2.0.4.The size of the software is only 1.33MB
    Just run and restart the computer.

    Now your problem wiil be solved.

  135. sakthi says:

    regedit/HKEY_CURRENT_USER/software/Microsoft/internet explore/main
    to delete lard rahul

  136. sakthi says:

    regedit/HKEY_CURRENT_USER/software/Microsoft/internet explore/main
    to select the main, Click on Window Title you can see LORD RAHUL COOL on Data. Double click on Window Title and Remove it.

    Thank u