How to remove Imgkulot, Kulitut, bbgong, bungoton, & burangos

Imgkulot is simply annoying which copies itself to any storage devices available, including your hard drives, flash drives, even the memory cards of your mobile phones, digital cameras, and mp3/mp4 players.

In particular, imgkulot copies and hides the following files:

• Autorun.inf - It is not a virus perse. Generally, it’s an instruction file which, as its name implies, runs automatically when a drive is opened. Though, this is the part that launches the actual virus.
• Imgkulot.vbs- A VB (Visual Basic) Script which is the actual malware (malicious software)/virus.
• imgkulot.reg - a part of the malware which is saved in the windows registry.

 Double clicking on the infected drive(s), like we usually do, would launch the virus and when you insert another removable drive (flash disk or even the memory card(s) of your mobile phones and digital cameras), the virus would copy the files listed above to the uninfected drive. 

Removing imgkulot

You can remove it manually by removing its entries in all your drives (including flash drives and memory cards) and in the registry. I do hope we are using the same operating system, Windows XP.

To begin with, kill the process from the memory. 1. Bring up Task Manager by pressing ‘Control+Alt+Delete (Ctr+Alt+Del)’,2. Click on the Processes tab.
3. Look for Wscript.exe from the list and select it
4. Press End Process

This will prevent the virus from writing itself on the drive again after you delete it (next steps)

• Open the Infected Drive
  - If you right click your drive and see something like the figure above,
           the best and safest  way to access it, is: From the start menu click Run…:

  WARNING! Unless you know what you are doing, DO NOT DELETE OTHER FILES aside from the ones listed here

• Delete the Autorun.inf and the three files with imgkulot names.
  -imgkulot.vbs
  -imgkulot.bat
  -imgkulot.reg
  (Other known variants: bungoton.vbs, bunguton,bat, bunguton.reg and kulitut.vbs, kulitut.bat, kulitut.reg)
• For safety reasons, go to Folder options again and View Tab and select Do not Show hidden files and folders
  and Check Hide protected operating system files

After doing so, launch registry editor by typing “regedit” in RUN textbox and press enter key. Then press Ctrll+F to find and delete for all imgkulot entries. Watchout if you saw these entry;

double click the value in the right and delete ONLY the imgkulot (other variants; kulitut, bbgong, bungoton, burangos). Userinit.exe should be left untouched. Please find other variants mentioned for you maybe infected with it.

IMPORTANT: Please turn-off system restore to all of your drives.

     Another thing is you should perform the above mentioned procedure in safemode. To execute safe mode you should press F8 several times to be sure before windows launchs. Select safe mode and press enter key.( See image below).