Lord rahul cool virus

My Internet Explorer is infected with “lord rahul cool.” It shows on the title bar. Please advise on how to remove “lord rahul cool” virus on my laptop. Thanks

135 Comments

  1. harbans mahajan

    Dear Sir

    Our window exployer diffected with lord rahul cool virus plz send the solution. soon becouse our imporant data unscure.
    deepak mahajan
    9312478436

  2. manu shukla

    Dear Sir

    Our window exployer diffected with lord rahul cool virus plz send the solution. soon becouse our imporant data unscure.
    deepak mahajan

    09919411160

  3. B'bec

    LORD RAHUL COOL WASTED MY EIGHT HOURS. The solution came simple. Followed below steps:
    1. Click on Any folder.
    2. Click Tools – Folder Options – View – Hidden Files & Folders
    3. Mark Show hidden files and folders
    4. Unmark Hide extensions of Known file types
    5. Unmark Hide protected Operating system files (Recommended)
    6. First two files were seen on my flash drive : Rahul’svirusprotection.vbe & autorun.inf
    7. Click on the properties of both file and unmarked Read only.
    8. Clicked Apply & deleted both files.
    9. Searched for Rahul*.* on hard drives.
    10. Click on the properties file and unmarked Read only deleted the file.
    11. Now LORD RAHUL COOL is out of my browser.

  4. krishna

    i am not able to delete that file..it says its being used and to delete we have to close that program first…

  5. Tamil

    Hey coolll
    use this below freeware software to delete ur file
    filehippo.com/download_unlocker/

  6. Tamil

    hey don’t fear this is not a virus i think………
    do it now………

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value
    ********************

    Window Title : LORD RAHUL COOL ”’delete this value or change it.

  7. A.Joseph

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    Window title not change after editing

  8. namy

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    after doing all this the problem is still there

  9. kip

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\
    ————————————————————-

    delete the key value

    after doing all this the problem is still there

  10. Basil

    Hey!!
    i followed all the steps you gave me bt it dd’t work, plz can you find other solutions for this LORD RAHUL

  11. Bruno

    After doing all you adviced me still the problem exist

  12. Bruno Moshiro

    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto this KEYS into registry editor

    HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN
    Still the problem exist even if you repeat the process several times

  13. subash

    your all answer not workout

  14. Tamil

    ok friends cool i give another one …

    actually this is a VB script file and located in System32
    directory, first you delete this file from this location

    do it
    In Windows Explorer…. following this steps
    Tools — > Folder Options —> View(tab)
    check this one
    Show hidden Files and Folders …
    Uncheck this one
    Hide prorected operating system files (Recommended)

    Now you can view all system files and Hidden files into your drives….
    go to this system directory
    C:windowssystem32

    find this file one “Rahulsvirusprotection.vbe”
    and delete it…..then following the REGEDIT clear steps….it’s really very simple.

    if u can not found this file, please search word like *Rahul*.*

    if u can not delete this file, please search the software name like UNLOCKER 1.8.8 in google
    this small utility can delete this file very easily

    download here…..
    w w w dot filehippo dot com / download_unlocker/

    if this problem will persist don’t feel mail me jacobtn.tn at gmail dot com
    i can create a utility and send u …………….Thanks

  15. Tamil

    modify
    go to this system directory
    C:\windows\system32

  16. Dinesh

    Hi Tamil

    Your advice worked out for me to overcome this problem
    Thanks for your help
    Cheers
    Dinesh

  17. Tamil

    you r welcome Dinesh

  18. panneer selvam

    hai,=0A jacob……plzzzzzzzzzzzzzzzzzzzzzzzzz…help me..i cant…whatev=
    er you told everything i tried..in the registry editor also i tried…direc=
    tly i went there and changed the start page to http://www.google.com and i tried l=
    oading the page again the same issue.just tell me how to change the key val=
    ue there.there is no option called key value..what no i have to change the =
    key value..next thing i tried downloading the unlock 1.8.8. unlocked the fi=
    le from system 32 rahul file unlocked and deleted..again same issue..can yo=
    u give me some info about this virus,.how its getting affected..jacob plz j=
    acob..i cried because of this…plz plz ..i beg help me to resolve this iss=
    ue..my mobile no +919789650958….folder options also i tried..now i am usi=
    ng mozilla..in IE 6.0 i cant fix the issue..oh my god.i cant tolerate this =
    one.i have AVG …updated version its utter waste..otherwise any anti-spywa=
    re or mallware program able to resolve this issue..plz reply me as soon as
    possible…i am waiting infront my computer without fixing this issue i wo=
    nt go anywhere..i am refreshing my inbox and i am eagerly waiting for your =
    reply…or is there anyway to reinstall the ie alone…can you suggest me s=
    ome good anti-spyware software so that i will install that too in my system=
    ..really i cant do anything with this virus..simply i tapped out in this..i=
    e got affected but my mozilla is still working fine…its not affected…th=
    e biggest comedy is i formatted the system just before few hours..and it go=
    t affected by this…what a comedy…i dont know how my system alone gettin=
    g affected by new viruses..i cant understand these things…really if you c=
    ome up with the solution i will be really thankful to you..i tried searchin=
    g in google i cant find anything..i found only one solution given by you…=
    when this virus was found..and no blogs about this..only two links related =
    to this came in google. its not a famous virus or what..k i dont
    want to bore you more..i need a solution for this as soon as possible.. i =
    am waiting for your reply..if got succeed with the resolution..we will cele=
    brate this new year in a grand manner…k take care dude bye…=0A=0Athanks=
    and regards,=0Aselvam…..

  19. Sandeep

    Hi,
    By using Microsoft security essentials I’ve removed the “LORD RAHUL COOL” virus, and after that I’ve changed my home page and title by getting into “regedit”.Now, that virus has gone and still I’ve one problem, every time i log in into windows(Windows xp sp2) it is showing the below error message
    “Cannot find script file C:\Windows\System32\Rahul’svirusprotection.vbe”
    I’ve checked in startup it’s not there.
    and I’ve also checked these two files “Rahul’svirusprotection.vbe & autorun.inf”,they are not present in my “system32” folder.
    please tell me how to get rid of that error message…

  20. Siva

    After deleting the file “Rahulsvirusprotection.vbe” using unlocker 1.8.8 and following the regedit steps. There is no problem in opening page of internet exploler. but while restarting the system a command come telling the host script file cannot be found.

    Pls reply if anybody knows how to tackle it.

  21. Tamil

    Siva tell me the exacting errors….
    do you know about the Startup items in Windows.
    check this first…

  22. S SENTHILKUMAR

    my laptop is infected by lord rahul cool virus,
    kindly help me to remove this virus and send procedure

  23. Sandeep

    Hi siva, I’ve found the solution for your problem.
    If the error message is
    “Cannot find script file C:\Windows\System32\Rahul’svirusprotection.vbe”.
    Create a new notepad document and open it, Don’t type any thing in it, leave it empty and save it as “Rahul’svirusprotection.vbe”.Then place this script file in “C:\Windows\System32\” and restart your PC, your error will be gone…

  24. Guru

    The “Quick Heal” antivirus software cleans this virus.

  25. Tamil

    I didn’t see ur brief explanation .Mr Paneer selvam ………sorry for late reply because I called your mobile number but you didn’t give any respond me….

    it’s not a virus ,harmless. i really saw it’s original source code.it’s a vb script file. Please refer 14th message in this forum..

    Hello Mr Siva and Sandeep……..

    please go to this REGISTRY KEY, edit the keyvalue
    for windows host error messages.
    HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Win­dows NT\CurrentVersion\Winlogon
    and find the key like ….”Userinit”
    edit this value ……..
    “C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”

    to
    “c:\windows\system32\userinit.exe”

  26. panneer selvam

    actually tamil resloved my issue..after deleting the virus in the logon you will receive the message cannot run the script like that..follow this procedure…start–>run–>regedit..and go to the following path.. i will give you…heykey_local machine–>software–>microsoft–>windows NT–>current version–>windows logon…go there and delete the second path..thats for rahul cool virus..keep the first one alone and delete the rest..for ex:keep like C:WINDOWSsystem32userinit.exe..save then exit..thats all..next time it wont show the message

  27. Kashyap_128

    krishna
    December 15th, 2009 at 4:37 pm 4

    i am not able to delete that file..it says its being used and to delete we have to close that program first…
    ____________________________________________

    open taskmanager, then END PROCESS of file named wscript.exe. Then, try to delete the file

  28. Kashyap_128

    LORD RAHUL COOL^the troublesome file^
    1. Open TaskManager
    2. Then click END PROCESS of file named wscript.exe.
    3. Go to C:/Windows/System32/
    4. You’ll find a file named Rahul’svirusprotection.vbe which I think is a Visual Basic file.
    5. Then delete the file “Rahul’svirusprotection.vbe”.
    The Problem of auto-opening of ZOOMSHARE Website and problem of LORD RAHUL COOL will be over… :)

  29. Vidhyadharan

    Tamil u rock man..Thanks alot man… your solution really solved this problem.. F**K LordRahulcool

  30. john

    my browser shows LORD RAHUL COOL at the top..i followed steps advised by Tamil..but i cudn’t find Rahulsvirusprotection.vbe” or *Rahul*.* in my wondows/system32..plzzzzzzzzz tell me how to resolve it???

  31. john

    my browser shows LORD RAHUL COOL at the top..i followed steps advised by Tamil..but i cudn’t find Rahulsvirusprotection.vbe” or *Rahul*.* in my wondows/system32..plzzzzzzzzz tell me how to resolve it???

  32. joseph

    Thanks for your suggestions… i ve deleted that virus but still when i log on to my system it shows ” cannot find script file “windows\system32\rahulsvirusprotection.vbe” I cant guess actually what the problem this…

  33. Arun

    Pls take a look at it, I had the problem too and got it fixed from netcat Location: madras, south, India . His explanation follows:

    One of the most famous worms which attained star status during 2000 was the ILOVEYOU worm. It was followed by many variations of the same, but not deadly as the original. Indeed it was a surprise worm to the world, wrapping itself as a simple love letter text file. The ILOVEYOU worm spreads through emails using the Microsoft outlook mail software.
    Next came the netlog worm or Network.vbs, which infects the Microsoft operating systems. This worm spreads through windows file shares instead of emails. It can easily spread to the entire network connected with the file share. Just searching and deleting Network.vbs file in the computer can remove this kind of worm since it wasn’t that much intelligent.
    Here I’m going to disassemble a similar type of worm which spreads itself through USB pen drives. It has got many variants like “lord rahul cool” or boot.vbs, sys.vbs, VirusRemoval.vbs and Semiantivirus.vbs. Actually it’s my first hand experience with this worm which affected one my colleague’s PC that prompted me to write this article.
    The attack:
    One fine day some of my colleagues complained that some sort of virus has attacked their system which pops up messages when they open the internet explorer browser. I tried to find out what they did in common. They didn’t install any new software, or didn’t access any network share nor did they download any new exe program. But they were all listening to the same music!
    As we used to share mp3’s and movies in our office, it’s quite usual that we use pen drives for transferring the files. And one of these could have infected their system.
    Work lifecycle:
    It starts of as soon as the USB pen drive is plugged in. The Autorun.inf file in the pen drive loads our worm script which is hidden in the pen drive itself. The Autorun.inf file has a similar entry like:
    [autorun]
    open=hiddenscript.vbs
    icon=autorun.ico
    Since the Visual basic script can access the file system and windows registry these worms do alter the files/registry values according to their author’s purpose. They copy themselves to the windows system32 folder and make them hidden in windows explorer by modifying the registry value at:
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue
    This worm has got the following characteristics:
    * Changes the internet explorer window title to the author’s own statement like “LORD RAHUL COOL”. This is done by editing the registry at HKCU\Software\Microsoft\Internet Explorer\Main\Window Title
    * Changes the internet explorer startup page to their own by editing the value at HKCU\Software\Microsoft\Internet Explorer\Main\Start Page
    * Also modifies the HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit registry value to launch the vbs script on windows login by calling wscript.exe.
    * These modifications are done even if we try to alter it manually, since it is programmed to repeat the same action every 1 second.
    Removal:
    At first I thought removal was quite easy. So I just terminated the wscript.exe which runs the script from the task manager and then tried to look for the vbs script but couldn’t find it. But once the system was restarted the worm came back in action. This time I spotted all the registry keys and removed them and then terminated the wscript.exe. But still the worm was inside. Then after learning about the visual basic script worms I found it that they can exist with vbe extension. So I searched for them and found them hidden inside the windows folder.
    Now I first stopped the wscript and next trashed the vbe file and then altered all the registry values back to normal. Now I restarted the system and it was all gone.
    One thing I’d not like to forget mentioning is to trash the vbe file in the pen drive and edit or remove the autorun.inf in the usb pen drive. After all that’s the source of trouble!
    Follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del.
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

  34. Arun

    Follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del.
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

  35. Arun

    Dont forget to turn on wscript.exe after the removal.

  36. janani

    hi i’m jenny…i deleted d rahul virus protection frm d system32 by using d unlocker but still it is showing on d top of my webpage…pls help me ppl….

  37. janani

    hi now i changed my web page but still it is showing lord rahul cool on d top of the page

  38. santhosh

    Hi friends,

    After doing this when i start my system it’s showing popup like this

    con not find script file “C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”.

  39. anand

    Hi , Can someone reply for the error after booting the system I am getting

    “con not find script file “C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”.

  40. janani

    ya d same prob for me too pls help us guys

  41. anand

    Did anyone try the below option ?after deleting the virus in the logon you will receive the message cannot run the script like that..follow this procedure…start–>run–>regedit..and go to the following path.. i will give you…heykey_local machine–>software–>microsoft–>windows NT–>current version–>windows logon…go there and delete the second path..thats for rahul cool virus..keep the first one alone and delete the rest..for ex:keep like C:WINDOWSsystem32userinit.exe..save then exit..thats all..next time it wont show the message

  42. janani

    thanks a lot ppl…..

  43. Prem

    Dear Friends,
    I removed rahul c(P)ool Virus.But i could not turn on wscript.exe

    rahul and autorun.inf files deleted but title bar showing the same.
    Please rectify my problem Friends.

  44. Prem

    Thanks a lot friends .That malicious program has been removed.
    Then kindly help to protect my PC free of charge with free programs.kindly refer some good program names like malware and virus scan and adware and spyware remover.

    mail me please
    sjsurya03 a t gmail dot c o m

  45. Jacob

    hello Friends don’t fear about this virus it’s really harmless ….this is Tamil…i already post more msgs to solve this problem…and i create a small Lord rahul virus removal utility with Vb.net and upload google groups with source code if any want to this utilty go to this page
    ……(bs = Back Slash, dot = .)
    http:bsbs
    groups dot google dot co.in bs group bs remove-lord-rahul-cool bs files?hl=en&upload=1

  46. r.prasad

    how to remove lord rahul cool virus

  47. Pc

    send me your mail id’s i will send the LORD RAHUL COOL removable utility…
    if u know VB.net also i willl send the Source code tooo..
    pc8181 at gmail dot com

  48. thalapathi

    search “Lord Rahul” in google groups……………

    groups dot google dot com

  49. sudharsan

    I couldn’t find rahul’svirusprotection.vbe and autorun.inf files, since my anti-virus software deleted those files
    Even then i’m facing the same problem

    I’m seeing “LORD RAHUL COOL” in the title bar of IE

  50. Senthil

    Hello panneer selvam,
    I did all the procedure in your post. Now its showing “there is no script engine for file extension.exe ” when i start my system. can u(or)any one fix this?

  51. Senthil

    tamil can u fix my problem?

  52. anny

    wats up!!!!

    still this rahul killing me a lot tried all the way but no solution, the bad luck i can’t go to regedit if i go to regedit it takes me to notepad where i cant read the contents there dont know may be chainees
    pls any more help plsssssssssss.

    annynkya at gmail dot com

  53. Prabhash Paudel

    I have removed the virus LORD RAHUL COOL but it still appears on the top of internate explorer.So please give me idea to chante LORH RAHUL in to internate explorer.

  54. Dhan

    Thanks friends, this is really helpfull and it works fine..kudoos to all for your efforts

  55. gaja

    Lord rahuls cool virus can remove by MCAfee antivirus. you can try & tell me.

  56. im4mmars

    Hey Guys, Please contact the author of this virus @ 9841414060. It is mentioned in the Rahulvirusprotection.vbe file. Check yourselves

    z

  57. Arul

    Thanks guy, I the solution given worked prefectly. Disable wscript.exe thru the task manager,Removed .vbe file from the system32 directory, and removed it thru regedit as mention above. Keep rocking guys..

  58. akila

    tamil man you rock or what…
    it was very kind of you helping us with all the steps..
    that virus was a pain.. i tell you i had almost a coupla hours of panic!!
    thanks man!!

  59. muthu

    hello sir,
    I have successfully the the lord rahul file.
    Even though the file has been deleted whenever I use pendrive it should be appear on pc.how to resolve this problem..

    [autorun]
    open=wscript.exe Rahul’sVirusprotection.vbe
    icon=%systemroot%\System32\SHELL32.dll,8
    action=Open folder to view files
    shell\open=Open
    shell\open\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Auto=AutoPlay
    shell\Auto\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Explore\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Find=Search…
    shell\Find\Command=wscript.exe Rahul’sVirusprotection.vbe
    shell\Format…=Format…
    shell\Format…\Command=wscript.exe Rahul’sVirusprotection.vbe

    this message should appear in pen drive’s auto run file…

  60. Tamil

    Hello Muthu….
    please try Kaspersky 2010 Internet Security…

    welcome akila ….

  61. maatu

    let me know how to remove lord rahul cool spreaded in all the clients within a LAN. i tried to remove in one computer but it return again. i tried to remove in another computer with the same method using run-regedit etc butit was not seen
    help me on how to remove this virus spreaded in a LAN

  62. bhubal

    hi, Tamil,
    it really worked well in Mozilla also.thanks a lot.
    bhubal

  63. Ramesh Thapa

    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.
    Ramesh Thapa ( Nepal)

  64. nandhini

    hi tamil…
    you really rock man!!! thank you so much.. i removed tat LORD RAHUL COOL virus following ur instructions…thank u so much.. its really sweet of you helping us.. thank you!!!

  65. Raj

    hi Nandhini:
    Thanks for ur nice msgs….n you r welcome…!it’s really encouraged me….

  66. sivakumar

    when i start window , window/system32/rahuls virusprotection.vbe is not found is comes……… how to remove this from my system can anybody help me please…

  67. jack

    Its really working as tamil suggested.Rahulsvirusprotection.vbe will be avl in C:windowssystem32. If U cant delete it first download and install unlocker software from filehippo.com/download_unlocker. then select the file and rightclick and select unlock. Then press unlock all.Now delete rahulvirus file.
    for changing internet explorer title:
    1— Start>>Allprograms>>RUN
    2—- and type REGEDIT into run window
    3—– goto HKEY_CURRENT_USERSOFTWAREMICROSOFTINTERNET EXPLORERMAIN
    here modify window title to Internet explorer instead of LORD RAHUL COOL.THATS ALL. ONCE AGAIN THANKS Mr.TAMIL

    to find & delete this rahul virus in pen drive follow as B’bec suggests.

  68. Tamil

    Verty simple steps to Remove Lord Rahul Cool
    ********************************************

    Virus Name : “Rahul’sVirusprotection.vbe”
    Format Type : Vb Script(visualbasic)
    File Size : 18.47 Kb
    Location : System directory (C-windows-system32- Rahul’sVirusprotection.vbe)

    Find:
    1) Internet Explorer window title bar name changed like : LORD RAHUL COOL
    2) internet Explorer Startup page is “http:–www.nyd.zoomshare.com”
    3) Wscript.exe process running

    Affect:
    change the registry keys and spread one to another system

    Remove:
    1) In Windows Explorer
    Tools — Folder Options —View
    Show hidden files and folders —-check this one
    Hide prorected operation system file(Recommended) —Uncheck this one

    2) GO TO System Directoty ex: (C:–windows— system32)

    find this file “Rahul’sVirusprotection.vbe” and delete this one, if u can’t do that following the below steps

    1)open the TaskManager(press control+Shift+Escapte key) in process Tab find ths Process “wscript.exe” and delete this one
    or
    2) using Unlocker 1.8.8.exe (search in Google site) for delete this file

    3) Type Regedit.exe into RUN Command
    HKEY_CURRENT_USER – SOFTWARE – MICROSOFT – INTERNET EXPLORER – MAIN
    Window Title = “”
    Start Page = “www.google.com”
    HKEY_LOCAL_MACHINE – SOFTWARE – MICROSOFT – Windows NT – CurrentVersion -Winlogon
    Userninit = “C:WINDOWSsystem32userinit.exe”

    Tamil…….

  69. arunkumar

    In system32 folder I cant find the file Rahul’sVirusprotection.vbe.. But I have this problem.. I have tried all the ways to find the file there but I could not find the file in system32 folder.. How can I find that file in that folder? Firstly I have to find that file to delete it..

  70. arunkumar

    Finally I found that file.. Thanks for the tips tamil.. Now the problem is solved..

  71. arunkumar

    Finally I found that file and deleted.. Thanks for the tips tamil..

  72. pparam

    im not able to see the folder options in tools and is there any other way to resolve this virus??

  73. Tamil

    Hi Pparam ur registry has more problems i think,bcz some viruses delete the FolderOptions Registry keys, so ur pc more than one Viruses i think.Please check your system with good Anti virus program.

    it’s k i give the solutions to You….
    ————————————-
    In Run command Type GPEDIT.MSC. now you can view the windows GROUP POLICY EDITOR.

    GOTO this Keys properly(Left pane Side:….)
    —————————-
    USER CONFIGURATION
    ADMINISTRATIVE TEMPLATES
    WINDOWS COMPONENTS
    WINDOWS EXPLORER

    now right pane side (it’s are important values for Explorer)
    ————————————————————
    double click this option
    REMOVES THE FOLDER OPTIONS MENU ITEM FROM THE TOOLS MENU

    changed to “NOT CONFIGURED”
    if “ENABLED” then the FolderOptions must be hide, so please choose the “NOT CONFIGURED” option. Then open the Explorer window now you can
    view the FOLDEROPTIONS menu…

    Thanks to READ
    TAMIL

  74. SUBRAT

    Hi, Tamil,
    I am Subrat.Still a am not remove that virus from my laptop plz. advice me.Only i remove the title bar name from internet explorer\main .I amnot found the virus file.When i log in laptop the same msg. is displayed c:\windows\system32\Rahul’sVirusProtection.vbe..Plz. tell me that solution.

  75. Janani

    Thanks a lot Mr. Tamil :) its really working out..
    Once again thanks a lot :)

  76. Janani

    When i plug my pendrive or ipod to my lap, its shows autorun.inf . is this the virus ? and also am not able to reject the flash drive properly.. Kindy help me

  77. MDU

    you r welcome Miss.janani …all autorun.inf files are not a virus.
    please mail me that files, i must help you.
    jacobtndotin at gmail dot com
    please install any one advanced Internet Security software like
    Kaspersky IS , Avg IS, Norton IS…..ur lap will be safe.
    i am using KVP IS 2010. it’s really worth.
    Thanks Janani…
    Tamil.

  78. Thiagarajan

    Good job tamil!

  79. S.K.Thambi Thurai

    guyz i can’t remove tht f***ing virus… pls help me out.. !

    when i open my browser it automatically goes to zoomshare website.. pls help me out..

  80. S.K.Thambi Thurai

    i have kaspersky 2010.. still it cant remove it.. the prob is still persisting

  81. panagudi genius

    hi janani,
    No need to send mail and all.just download the software name autorun eater..and install it..just scan your system using that software.and fix it..thats all..its 2 min work.that software size is only 1.33mb only..just try it..if you have any issues..update here i will resolve

  82. Sagar

    yes he resolved all problems.because he is Panagudi Genius.

  83. sandy

    thank u tamil.now my prob ill be solved..
    keep it up

  84. Visalakshi

    I am able to delete the lord rahul cool virus file from system32 file.. But unable to delete the name displayed on my internet homepage title bar. I tried entering the regedit option and by mistake i deleted the key called Start Page from HKEY_Local_MachineSoftwareMicrosoftIEMain. Pls guide me how to recover that key and how to get rid of this virus from my title bar……

  85. Tamil

    Hello Visalakshi
    do that steps

    Open a Notepad editor.
    copy this below values and save with extension .reg
    for example “Visalakshi.reg”
    then double click this file.
    you can restore that values.

    Windows Registry Editor Version 5.00
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
    “Start Page”=”www.google.com”

    jacobtn.in at gmail dot com.

  86. karthiga

    whenever i click on my thumbdrive, it doesn’t let me access it and it says: ‘can not find script file “H:\Rahul’sVirusprotection.vbe’

    and i also can’t see my folders, when i try it on a differnt laptop i can see them as hidden files, what should i do? is this rahul thing a virus?

  87. AnNiHiLaToR

    Hi
    Don’t worry people it doesn’t do any harm, just looks like a prank.
    Here is a way to remove it. Its quite simple.

    It uses a process called “wscript.exe” so go to task manager and end the process (Processes tab -> Click on Process name “wscript.exe” -> Click on “End Process”)

    Now look for the 2 files “Rahul’sVirusprotection.vbe” and Autoplay.ini in your flash drive.
    Go to properties of these files and revome “Read Only”. Then Shift Delete.
    “Rahul’sVirusprotection.vbe” will also be present in your C:\WINDOWS\system32 so remove read only and delete from there as well.
    search for the file and delete in found anywhere else.

    Hope that helps.

  88. Tamil

    download and try it.
    Autorun Virus Remover V2.3(Jan 06, 2010)
    Autorun Eater 2.4

  89. M.Abdoul Bazid

    thank you very very much Kashyap_128

  90. Deva

    thank u Mr.Tamil you are a Rock man.

  91. Visalakshi

    Hi Tamil,

    Each and every time when I login my System, the clock timings are getting changed.. So each n every time I need to adjust the timings.. It shows the 2006 year calendar and timings.. Pls help me to have a proper and a correct timings when I log in..

  92. Tamil

    hi visa
    First find this Tnuzmtmi.dll file in ur system root directory.
    if it’s not please check ur Bios Battery.

    *****Tamil

  93. Prabha

    Tamil,

    Thank you very much….your solution works for me too ….
    Thanks once again

    Prabhakaran

  94. Tamil

    you are welcome Mr Prabhakaran.

  95. raghav

    b’becs answer is very very very good and pacca

  96. Krish

    hi Iam krish here too help u around… i have the same vrus in my system…here is the idea to remove it completely from ur system

    dont use any software its is a core removal idea….

    start > restart > press F8 for safe mode. LOGIN to ur system in safe mode.

    Then Open RUN > %COMSPEC%

    u ll get an Dos prompt in system32 DIR.

    C:\WINDOWS\system32>

    type DIR/ah

    C:\WINDOWS\system32>DIR/ah

    >it ll show u an list..

    becareful thats ur system basic files… in that u can find the
    Rahul’s antivirus protection.vbe file

    at this time open ur system task manager ALT+CTRL+DEL at ur desktop

    click PROCESS

    in that u ll find an image name called “wmscript” like that

    just right click on it and click end process tree.

    Now back to dos.

    >after that list.

    Type “DEL /a:h Rahul’s antivus protection.vbe”

    this will be full command

    C:\WINDOWS\system32>DEL /a:h Rahul’s antivus protection.vbe

    den find for other files like “sys drv_.dat” Sys_drv.dat… like that..

    all .manifest files are SYSTEM FILES BEWARE DON’T DELETE IT

    Also DLLCACHE is system file… thatssol…. he is out of ur system….

    now at ur next restart it ll show u that could not load the script

    Rahul’s virus protection.vbe.

    hxxp://free.antivirus.com/hijackthis/

    just install this software… run a scan beware after scan it ll show 2 files of the RAHUL’s antivirus protection in the scanned list… as a issue just click that checkbox and clear issue… thatsol..

    dont check other box this software may damage ur other softwares if u click other checkbox…..

    Krish

  97. asif

    hello tamil
    can avg,kaspersky remove rahul cooool?

  98. Yes

    hello asif
    Kaspersky removed this Virus
    but im not check with AVG….
    Tamil.

  99. asif

    what about esset nod 32?

  100. RONILITO MURILLO

    how to solve my problem.

  101. Swetha

    Krish it’s too much step it’s already resolved by some other with simple steps.

  102. Clinton

    Hey guys unlocker is not required. Just open task manager and end wscript.exe
    To open task manager ctrl+alt+del
    After ending that you can easy delete rahul’svirusprotection.vbe from system 32

  103. Bomvau

    How to I remove the dialog box which shows at startup reading “Cannot find RahulProtection.vbe”

  104. dino

    Follow this very simple..it removed rahul cool from IE

    thanks to Ramesh Thapa

    Ramesh Thapa said:

    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.
    Ramesh Thapa ( Nepal)

  105. murali

    dino and Ramesh Thapa(Nepal) both id’s are same guy..hhehhehehehe

  106. chrome

    Thanks Ramesh.
    Worked fine

  107. Mishba

    what worked fine mr.Chrome….

  108. virender

    This is cool stuff. I tried

    dino said:
    Follow this very simple..it removed rahul cool from IE
    thanks to Ramesh Thapa
    Ramesh Thapa said:
    Follow this:
    1. Start
    2. RUN
    3. Type REGEDIT into run window
    4. HKEY_CURRENT_USER\
    5. SOFTWARE\
    6. MICROSOFT\
    7. INTERNET EXPLORER\
    8. MAIN
    9. Now you can see Name, Types and Date on right pannel
    10. Click on Window Title ( you can see LORD RAHUL COOL on Data
    11. Double click on Window Title and Remove it
    12. Restart your browser. Now you are safe from that.

    This works.
    Thanks

  109. virender

    Well i had to apply the following steps to kill the virus names rahul.

    Just open task manager and end wscript.exe
    To open task manager ctrl+alt+del
    After ending that you can easy delete rahul’svirusprotection.vbe from system 32

  110. shinto

    well done ramesh thapa
    i have successfully removed lord rahul from mysystem i followed ur steps thank u

  111. Suga

    hello tamil can u tell me about computer management i wana reset my explore default settings …..thanks for removable utility for this virus. well done job once again thanks a lot………

  112. naafia

    my pen drive is with rahul antivirus protection.vbe i cant open my files which i stored in it… they are very important… please send me a solution to overcome this…

  113. Problemchild

    One more in c:/windows/system32. you need to delete 2 files:
    wscript
    nwscript

    Then go to regedit, click on search and put the value as Rahul, where u find the value name rahul just change the value to 0 or 1. DONT DELETE. click on F3 to find next…

    -Problemchild

  114. Vinod.S

    Thanks what
    “”””#13 on 18 December 2009 at 2:34 pm Tamil said:”””””

    was perfectly correct i just downloaded that software & got deleted that Rahul virus now working safely.

    Thanks Tamil.!!

    bye

  115. Guru PrasaD

    Hey guys…..i followed the steps below and finally got that crap outta my system!!!

    This was all i did in my computer…

    Ensure you hav the Administrator privelege before you start
    1.Hit the ‘F3’ button and search for ‘Rahul’svirusprotection.vbe’…
    2.Be sure to check “Search System Folders” and “Search hidden files and folders”…
    3.Search in “C:”…
    4.Delete the file that u get…it will be named ‘Rahul’svirusprotection.vbe’

    Then follow the steps:
    1. Go to Run and type System 32
    2. Search for wscript.exe which will have a red icon. Click on stop and apply and ok.
    3. Now search for rahulsvirusprotection.vbe and press shift + Del
    (you may not even find the file coz u already deleted it in the previous steps)
    4. Now restart the system.
    5. Then connect ur pen drive Go to folder options and select Show hidden folders and files.
    6. Now u will find autorun.inf and lord rahuls protection.vbs, press shift + Del.
    7. Now ur browser will be free from it.
    8. Now open regedit, HKCU\Software\Microsoft\Internet Explorer\Main\Start Page and change the value to ur own webpage.

    And please go to this REGISTRY KEY, edit the keyvalue
    for windows host error messages.
    HKEY_ LOCAL_ MACHINE\SOFTWARE\Microsoft\Win­dows NT\CurrentVersion\Winlogon
    and find the key like ….”Userinit”
    edit this value ……..
    “C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wscript.exe C:\WINDOWS\system32\Rahul’sVirusprotection.vbe”

    to
    “c:\windows\system32\userinit.exe”

    That’s all you hav to do…. :D
    Hav fun folks :D

  116. Jeevs

    Hi Tamil,

    you are rocking man.Thanks a lot for your tips to remove the virus.Can i get your mailid.

  117. jeevs

    Anyone help me to solve this problem.if i restart the system i receive
    the following message.
    “C:\windows\system32\Rahul’svirusprotection.vbe” could not be found.

  118. Robin

    i Used Bitdefender antivirus it removed

  119. annamalai (Sun Computers)

    This problem very simple download kaspersky internet security 2010 to activate trial license to update up to date clean rahu virus

  120. Madurai Tamil

    Jeevs said:
    Hi Tamil,
    you are rocking man.Thanks a lot for your tips to remove the virus.Can i get your mailid.
    ‘************************************

    Hello Jeevs., Thanks for your comment
    my mail id is Jacobtn[dot]in[at]gmail[dot]com.
    i m from madurai in TamilNadu.

    and welcome mr.Vinod.S

  121. anti rahul virus cool

    start ur computer…..press F8……login in safe mode…..run regedit….in view option go for

    “find”…..type “rahul”….u’ll find a parameter with rahul……just delete it….restart ur

    pc….go in normal mode…..go to start…run…type “regedit”……in view option select

    “find”…..type “rahul”…..delete the parameter u find in there named rahul..now u removed

    that virus i bet…enjoy dude.

  122. shrishti

    thank you your answers solved my problem. I like this website thank you

  123. vipin narula

    Dear sir

    I have an error message in my system “there is no script engine for file extension .vbe ”

    Please suggest me that how can i remove this message.

    Thanks & Regards

    Vipin Narula
    9888069980

  124. ameya

    Plz tel me how to remove lord rahul cool virus from my laptop?

  125. Ravi

    Dear sir,
    Beacuse of load rahul cool virus my computer pointer is unable to move please send me a solution to it. I am from rural area.

  126. Arun,karungal,nagercoil,tamilnadu,india

    Open notepad.dont type anything in notepad and save this file as Rahulvirusprotection.vbe in directory c:windows/system32.then restart the computer.thats all.

  127. Suria Prakash

    First
    Open task manager and kill process wscript.exe.

    Then
    Delete VirusRemoval.vbs and Autorun.inf files from all usb drives if u have the virus in them.

    Then
    Go to c:\Windows\System32 and delete the file VirusRemoval.vbs. It is super hidden so first go to Folder Options and check show hidden and check boxes. Also required for the above files.

    Then
    go to start>run and type regedit and enter
    Go to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
    On the right side look for Shell which should have value of just explorer.exe.
    delete anything at right side of explorer.exe if there is anything.

    Under same key Winlogon also look for Userinit which should have value of
    c:\WINDOWS\system32\userinit.exe,
    Delete all the **** after the comma.

    Then
    Go to HKCU\Software\Microsoft\Internet Explorer\Main
    On the right side locate Window Title and delete its value i.e. Sujin.com.np

  128. Balasubramanian

    hi friends,I here asking you some tips as i follow the issue in my computer.Just
    start==controlpanel==maintainance and performance==seealso===system restore===set your system OS the earlier day of your system infected by this virus.It delete the virus and also installed .exe programs from that particular date and you have to lost some datas which is the .exe files only.System restore has not delete all saved and save as files.
    I solved this same issue and deleted the virus without make any changes.I think this is the only solution to understand easily.Try to follow this simple way.

    -Bala

  129. Jame

    Thanks a Lot.

  130. Livingston

    Hi Friends, i am livingston from chennai. I lost all my important documents as because of the Rahul virus in my pen drive. i dont know how to remove it. when i check for the space in my pen drive it shows 7.5 gb filled out of 8gb. but when open my pen drive it shows only a single folder called windows and four files called autorun.inf, boot.ini, NTDETECT.COM, ntldr. Can anyone call me and guide in this regards. Please…. please…. please……………. just give me a missed call. thats enough. i will call u. i dont have system in my house. i have to go to netcafe to rid off this virus from my pen drive. so plz call me and help me friends… if u dont want to call atleast mail me with the details. Thanks in advance. Plsssssssssssssssssssssssssssssssssssssssssss. My mobile number – 90800 17151.

  131. krishna

    Norton antivirus will fix it

  132. gayathri

    its so simple dude,..
    go to run command
    type “regedit”
    you will be displayed with the registry editor
    press ctrl+f
    in the file text box enter rahul’svirusprotection.vbe
    you will get the results
    right click on that file and and select delete
    the operating system will warn
    but just go ahead and enjoy!!!!!

  133. jino

    Hi Friends,
    One of the easy way to remove this virus is run one small software. The name is TREND MICRO HIJACKTHIS V2.0.4.The size of the software is only 1.33MB
    Just run and restart the computer.

    Now your problem wiil be solved.

  134. sakthi

    regedit/HKEY_CURRENT_USER/software/Microsoft/internet explore/main
    to delete lord rahul

  135. sakthi

    regedit/HKEY_CURRENT_USER/software/Microsoft/internet explore/main
    to select the main, Click on Window Title you can see LORD RAHUL COOL on Data. Double click on Window Title and Remove it.

    Thank u

Comments are closed.