This is a new kind of virus which is being spread through USB flash drive devices. It uses autorun.inf to trigger the infection. "Jaw-ly-bee-cute" virus was launched on the internet by codename: "Blackstrider", reportedly a computer student / programmer from Surigao in the Philippines, back in the last quarter of 2008.
How to know if you are infected by the "Jaw-ly-bee-cute" virus?
1. Once infected, the victim's computer will have the following lines displayed in the logon screen:
"Hi. Howaryu? Aym Jaw-ly-bee-cute 3 yehs old frum da bheig bheig manchion ein Shurigaw. Ayl stey hirh forawhile bcos duhbad ghuys tukmehan lefme sumwerh inda leibleib phleiys and ayduno how tu get bak howm. Dows badguys promishd me five moh box of cholate afterh ay join dem indahgeymof haydenshik. Little duhayno bout theyrh ploy of shelling me to dah burgoise. Gudtinh Jawllybeeismart to trwikdemowt anfund weyh hirh tuhuyd."Okay, this is the best translation I could think of.
"Hi. How are you? I’m Jaw-ly-bee-cute 3 years old from the big big mansion in Surigao. I’ll stay here for a while because the bad guys took me and left me somewhere in the liblib place and I don’t know how to get back home. Those bad guys promised me five more box(es) of chocolate(s) after I join(ed) them in the game of hide-and-seek. Little do I know about their ploy of selling me to the bourgeois. Good thing Jaw-ly-bee is smart to trick them out and find way here to hide."2. When you open Internet Explorer, you will be redirected to this page, which is just a copy of the uploaders page.
3. There will be pop ups or tabs that will diplay the following lines:
"I will be staying here for a while". "Jaw-lee-bee is watching you" and/or "Infect other computers through your USB within 5 days. Otherwise, you will be stung by a bee and you will die!"Pretty funny and childish things by the uploader but are annoying.
1. How to avoid the Jaw-ly-bee-cute virus? Disable your computer's autorun function. Click here for the instructions.
2a. How to remove the Jaw-ly-bee-cute virus logon notice? Go to Start > Run and type regedit. Expand HKEY_LOCAL MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon and find and remove the legal notice script as first mentioned.
2b. Find and delete autorun.inf and system32.dll.vbe in your disk drives including the partition drives. Restart your computer.
2c. Install Eset NOD32 and download the latest update. You can also follow this thread just in case you want to learn more about this new virus (the site has mixed Philippine local languages).
Reformatting is a last option so try the above steps first before thinking about it.