How to remove IMGKULOT virus

Most likely this originated here in the Philippines since a Google search shows that majority of the complainants seems to be from Filipinos. In addition the word ‘imgkulot’ fits the phrase “Oh my God, Kulot!”, with ‘kulot’ meaning kinky hair. Although not exactly a derogatory term, it is playful enough to elicit some laughs to those who will interpret it that way, most especially if the owner of the infected computer coincidentally has kinky hair.

Anyway, I spent a couple of hours of a weekend trying to remove the imgkulot virus from a family friend’s computer systems. It was the first time for me to encounter it. These are the symptoms I saw:

1. Infects all storage drives ie. hard drives, flash drives, ipods, mp3 players, floppies, etc.

2. When right clicking a storage drive you will notice “(imgkulot)” getting appended to your Open and Explore option.

3. Double-clicking infected storage drives activates the virus to start infecting other storage drives.

4. In some computer the virus also hides a copy of itself in the System32 folder.

To remove it you need to

1. Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. Select the “Show hidden files and folders” and check “Hide protected operating system files”. Click OK.

2. Type the drive letter of the infected storage drive in START –> RUN. Sample format minus the brackets [C:]. A window of that drive should open.

3. Be careful in doing this as you might accidentally remove important system files needed in starting up your computer. Delete the following:
(a) autorun.inf (b) all files with the name imgkulot. There should be at least three of them.

4. Repeat steps 2 and 3 for the other infected storage drives and in the System32 folder. To go to the System32 folder go to Start–> Click run –> Type minus the brackets [%SystemRoot%/System32/]. Again be extra careful in deleting, most especially when in the System32 folder.

5. Then undo the changes you did in step 1.

6. Restart your computer.

That should do the trick. If it you have a different solution do share it here. Remember if you really want to keep your computer safe try out Linux, but if you have the money, buy yourself a Mac. 🙂

48 thoughts on “How to remove IMGKULOT virus

  1. the only drive infected on me is my flash drive.i have deleted the autorun.inf already however,when i right click the drive name from my computer open(imgkulot) still appears. i checked the contents,no visible imgkulot files are found though my folder options indicate that hidden folders are shown.

  2. @cayshe

    are you sure that your drive C is not infected also? If you have done all the steps I have mentioned above and you are sure that the files to delete (autorun.inf and files named imgkulot) are no longer there AND you still get the named imgkulot on the drive THEN and ONLY THEN shall you do the following edits to the registry. Please be careful in doing any deletes in the registry as you may affect the performance of some applications if not of the whole operating system.

    1. Start –> Run –> Type regedit
    2. Click CTRL and F simultaneously to do a search
    3. type imgkulot
    4. remove all mention of imgkulot

  3. i’ve looked inside my drive C and i didn’t find any hidden files named autorun.inf and files named imgkulot, though my hard drive is still infected by it.

  4. The files that must be deleted cannot be seen immediately without some tweaking. Do the instruction below first to see them.

    Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. Select the “Show hidden files and folders” and check “Hide protected operating system files”. Click OK.

    Give us an update okay.🙂

  5. Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. Select the “Show hidden files and folders” and check “Hide protected operating system files”. Click OK.

    Yup, thats exactly what I did and no sign of any of those files that should be deleted.

    Anyway, I had to reformat my hard drive due to some other problem, so I guess my hard disk is free. But my iPod is still infected, and I’m not opening it because when I right click the removable disk (iPod), there’s no (imgkulot) beside the open option, but I fear that something might happen if I do open my iPod, so I’m only connecting it to the computer for charging purposes. I tried looking at it in a different computer, but still can’t find those hidden files that need to be deleted.

    I do, however, regarding flash drives, found out that scanning it with an anti-virus program would delete (heal), the virus, but STILL have the flash drive corrupted. But copying the files within the said removable disk unto the computer, then formating the removable disk, and putting back the copied files in the removable disk, would cure the flash drive of the virus. I don’t want to do this with my iPod of fear that the OS in it will get messed up with this crude process.

  6. @miggyboi
    I don’t have an Ipod so I can’t tell you exactly how to tinker with it. However if you get yourself a LiveCD of Linux like Ubuntu and run it on your computer then plug in your Ipod like a flash drive you could probably be able to see the hidden files not viewable under Windows and then erase them from there. Where will you get a copy of Linux? If you have a fast internet connection just download them at distrowatch.com. Just in case you did not know, make sure to download a LiveCD because this means you don’t have to install it anymore.🙂

    @jED
    Personally, in any PC problem formatting is my last resort. I don’t like to do it because I hate doing backups and repeating the customizations all over again.🙂

  7. @seraphim_wing

    Open any window of My Computer and My Documents. At the menu above you should see there the word TOOLS. Click that and a drop down menu will show. On the bottom most portion of this menu click FOLDER OPTIONS. Then click the tab View. Select the “Show hidden files and folders” and check “Hide protected operating system files”. Click OK. After these you may now proceed to Step 2.🙂

  8. I also encounter this pesky imgkulot virus. What i did was i reformat my drive c.so theres no trace of the imgkulot. my fear is when i access the flash drive and the infected drives, then the virus goes over the registry settings. and when trying to start again, it always auto shutdown so theres no way i can perform the entire procedures on deleting the virus. pls help..your suggestion is very much appreciated..thanks

  9. hehehe..thats a hell of a trick..it worked for me..

    yeah..try linux..much better..

    plus, you dont have to worry about microsoft guys on your doorsteps..

    slap your ubuntu disk on thier face! hehehe

    way to go..

    5 stars for this one..

  10. i went to the registry edit and deleted all the autorun.inf and imgkulot that i found. when i succeeded in deleting all of those, i found out that there was no more imgkulot beside OPEN when i right click the local disk.

    but when i restarted my computer, it didn’t open my user account. to clear everything, this is what i did after successfully deleting the imgkulot and autorun.inf while in safe mode in the registry edit

    -reboot computer in normally
    …processed..
    -the user accounts showed up
    -i chose my account. typed my password
    ….loading settings…
    -the system loaded my settings
    -then AUTOMATICALLY LOGS OUT

    it happens all the time, not depending on what user account i use. it loads up the account setting, then automatically logs out

    do you have any idea what caused this to happen?
    do you think i erased an important file or something that should not be deleted in the registry editor?
    i followed the procedure stated above
    pleade comment or recommend actions unto this matter
    thank you very much

  11. @jesiree

    I am afraid I may have bad news for you. The autorun.inf that you should delete is ONLY the one you find in the INFECTED drive. You MUST NOT delete the autorun.inf you find from the REGISTRY. What you delete from the registry are simply the ones with the word imgkulot appended to it.

    So what can you do? Two things…
    1. Try to do a system recovery.
    a. restart computer then presss F8 continuously. you should see a menu on how windows should start
    b. choose ‘boot in safe mode’
    c. follow instructions on how to do a system restore. try to remember what date it was before you made changes to the registry. Note that imgkulot could also be restored so follow the instructions again this time DO NOT DELETE autorun.inf from the REGISTRY.🙂

    2. I suggest you make a Windows recovery installation.
    a. get your windows installation cd and make sure that you boot from cd
    b. when you get to the section about what will you be doing, choose the option about doing a Windows recovery. This would take some time since Windows is doing a fresh installation of all its services but rest assured that your files will not be deleted. Just remember to choose the WINDOWS RECOVERY option. If you think you have made something wrong press F3 to cancel.

    I suggest reading the instructions given by Windows twice so you are sure that there won’t be anymore surprises after. Hope that helps!

    @santosh
    I am not aware that imgkulot virus also does this. Do you see any of the symptoms I mentioned above too? You might be experiencing a totally different virus. Could you please elaborate more?

  12. hi. i too encountered that imgkulot virus. when i try to double click my hard drives [to open] i get this msg — cannot find script file “C:\imgkulot.vbs” [imgkulot.bat at times]. what should i do? im afraid to touch and delete anything on the PC cuz i might delete something very impt. i’ve got no problems otherwise save from a very slow running PC and i cant access the hard drives by double clicking. Would my PC be safe it was vaulted? my AVG anti virus detected it few months ago. And does deleting viruses from the vault will affect the performance of files infected? tnx…

  13. @clueless

    when you double-click the infected hard drive the autorun.inf is activated and it finds the imgkulot file which AVG has already sent to vault to lessen damage done on your PC. To solve this problem all you have to do is delete this hidden autorun.inf file. How?
    1. Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. Select the “Show hidden files and folders” and check “Hide protected operating system files”. Click OK.

    2. Type the drive letter of the infected storage drive in START –> RUN. Sample format minus the brackets [C:]. A window of that drive should open.

    3. Be careful in doing this as you might accidentally remove important system files needed in starting up your computer. Delete autorun.inf

    4. Then undo the changes you did in step 1.

    5. Restart your computer.

    You ask if it will be safe to delete files from the virus vault. In most cases, this one included, the answer is a resounding yes.🙂 So go ahead and delete it.

  14. sorry I was able to delete them 1 autorun.inf +
    imgkulot files from drives C:, D: and F:(flash
    drive) but when i reboot my pc it is still ther.

    i wonder whats wrong. btw i uncheck the “Hide protected operating system files”coz i didn’t i will not see those imgkulots

  15. @Jag

    The possible reason is imgkulot has also infected your registry too. So what you do is.

    1. Start —> Run
    2. Type regedit. Registry window will open. Be very careful with what you delete here!!!
    3. Press CTRL + F to search
    4. Search for imgkulot then delete everything that pertains to it.

    Again be very careful with what you delete in the registry because there is no undo option here. Hope that works.

  16. i have a question wat do you mean by ur no. 5 step undo the changes you did in step1? meaning do i have to restore or copy that same file deleted from the system? just asking. thanks.

  17. @ H
    Step 5 states “Undo changes done in STEP ONE”
    Step 1 states “Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. SELECT the “Show hidden files and folders” and CHECK “Hide protected operating system files”. Click OK.”

    so to follow step 5 you
    “Go to Start –> Choose the Control Panel –> Click the icon Folder Options. Click the tab View. UNSELECT the “Show hidden files and folders” and UNCHECK “Hide protected operating system files”. Click OK.”

    Hope it is clearer now🙂

  18. The virus has also infected my PSP. Got any idea how to remove it? Well, I haven’t really tried your suggestion but I will give it a shot later. Also, I came across a program called spybot and what it does is that is locks the system registry so that files cannot automatically edit it. I think it works in trying to prevent the virus from spreading to other USBs as you will be prompted with a question if you want to edit your system settings or not. If malware is present, it it tries to change the registry every time you open storage drives. Well, I hope your idea works dude!

  19. @knix
    How were you able to determine the it is imgkulot then?

    @Alfred
    I am not sure how to cure it on a PSP since I do not have one to experiment on but try my suggestion to Miggyboi. Just see it on one of my earlier comments. About Spybot, it is not really an ultimate blocker of imgkulot. Yes it protects your registry but the registry is only located at your drive C. What if you have another partition? What about USBs that you have plugged in your PC. Spybot’s protection do not extend to these other drives. So yes your drive C where your operating system might be protected but that does not hold true for other drives (removable or partitions) on your computer.

  20. Hi, I have a different problem. My lappi is not opening my hidden files. I go to tools and then folder options -> show hidden files but still it is not showing the files to me.

    Do you know which virus it is?

    Please help me as i can’t see my important files (i hope you understand which hidden files).

    you can email me. Waiting for a positive response.

  21. hi..i have a nokia 6151 unit and it has (imgkulot) everytime time i right click the drive E: its when i connect my phone to my computer to get or transfer some data..i was afraid to open in,since i thought it might cause the virus to be activated..im using AGV and i scaned it too..it was detected,but i dont understand why i could see the (imgkulot) everytime i right click the drive E: pls help?..

  22. @ cearion

    If you have followed the instructions on how to delete imgkulot from the instructions but you are still seeing the imgkulot name when you right click the drive (in this case drive E) that means your registry needs to be cleaned also. If the imgkulot files in the drive were successfully deleted the imgkulot name you are seeing are just trash entries in the registry which you just need to remove. I think what is happening to you is same as what probably has happened to cayshe.

    Here is what you can do. Please be careful in doing any deletes in the registry as you may affect the performance of some applications if not of the whole operating system. Therefore only do this when you have already done the initial removal instructions I have mentioned in my post.

    1. Start –> Run –> Type regedit
    2. Click CTRL and F simultaneously to do a search
    3. type imgkulot
    4. remove all mention of imgkulot

  23. hello..i was able to remove the imgvirus completely..(i think) thankyou..
    but i still have a problem though.. its not related to the imgkulot virus..
    here’s the story.. few weeks ago i had limewire..so i downloaded few songs..
    and i tried downloading movies too..i had successfully downloaded some movies..
    but my last download was affecting my computer..everytime i would open it’s location folder, the computer starts to operate so slow..very slow indeed..so i need to restart my computer,and it would operate fine..but as soon as i open the location folder again,it would again slow down my computer..i tried to scan it with AVG,but no threats were found..is this a virus? i think you’re good at stuffs like this,so i decided to ask you about this..hehe..i know it’s kinda’ very far from “imgkulot” but maybe you could help me with this..i’ll take my chances..hehe..thankyou

  24. @cearion

    can you please be more elaborate?
    what folder are we talking about? — default set by limewire or you set it?
    what was your last download before it occured?
    are you sure you did not do anything else before the problem occured like installing a program perhaps?
    is limewire program also active when you access the location folder?
    do you happen to know the specs of your computer?

    I cannot give an exact answer for you problem. I can’t even say if it is a virus that causes your computer to slow down (even if limewire is a medium for viruses to spread) without doing the necessary testings to isolate the real cause. Think of it as a doctor that needs to ask a series of question and do lots lab testing.

    You can get lot’s of viruses from limewire so best if you stay clear from using it. Find direct downloads instead. If you spend some time with google your bound to find one.

  25. the “shared” folder its the default set by limewire.. every video and music i download from lifewire goes straight to “shared” folder.. the last video i downloaded from limewire was “batman begins”.. since all that was through..i opened the “shared” folder to watch the movie i have downloaded.. the limewire was still active when i opened the folder.. after that i tried to open the movie to watch it..i know it would take few seconds before it would open.. bet i think 5 minutes would be too much just to open a movie file.. i was already alarmed that something was wrong..because the computer runs so slow..very very slow.. refreshing it would take about a minute..so i tried to restart the computer..then my computer would ran normal again..so i tried to open the “shared” folder to delete what i have just downloaded.. “batman begins” but everytime i do..there’s always a pop out that would appear that says “unable to delete ‘batman begins’ some programs might be using it” it’s kinda’ like that.. after that the computer would run so slow again.. and the only option i have was to restart it again..after that i uninstalled limewire..because i thought it was the program that was using the movie file i have downloaded..but when i tried to delete the file,it always says “unable to delete……….” and again..it would run so slow.. i tried to scan my computer with my AVG 7.5 but it shows that no threat was found..what should i do?..help me pls..thankyou..

  26. There’s an easy way to remove it. Just simply download noob killer by leerz🙂 It can also remove “Taga Lipa Are” and also the pesky “I’m not the only one” virus that inhibits flash drives.

    IT can also remove variants of Kxvo.exe malware (it’s laveled as a password stealer) and also the virus nhatquanglan (which basically inserts gibberish language whenever you are typing a document or chatting in your YM).

    The noob killer basically works just like what royalflare suggested we do to eliminate Imgkulot. Only it does it for you (which lessen the risk of you deleting any important file in your computer.)

    I know all of this because I had all of those pesky viruses and tried removing it using noob killer. If you guys want to give it a try, you might want to check it out here:

    http://leerz25.sitesled.com/

  27. helo van..i tried noob killer..but my problem doesnt seem to end..it’s still unable to delete.. “unable to delete Batman Begins DVDRip Eng: some program might be using it” it’s what the computer tells me.. help guys?

  28. two things I can suggest so you can delete the last download
    1) prevent your limewire from opening upon start-up to do this either
    –> look at setting of limewire and disable anything that says automatically open at start-up (no instructions here coz I never use one) or something near that effect
    –> OR you could look at START->RUN->type msconfig->Then look at the tab Startup and look for something about limewire ( this might also be a good time to look at other application you can do without during start-up to quicken computer performance on first boot)
    2) Start your computer in safemode
    –> Under safe mode the most basic drivers and applications are loaded up so whatever nonstandard application like limewire you have should not activate automatically under safe mode unless you open them. In fact even if you do open them sometimes Widnows cannot open them since other needed drivers and programs are not loaded up under safe mode.
    –> restart your computer and press F8 continuously. Choose boot/start in safe mode in the choices given. You are not doing a system restore so don’t use it when it asks. Delete what you believe is the culprit file.

    Hope that helped somehow. Please do give an update how it went.🙂

  29. i still havent solved the problem on my computer..
    i still cant delete the file.. i tried nood killer.. the “delete file on restart”
    but then,it says “program not responding” hai…

  30. copy and paste sa notepad, save file as “removeit.bat” run batch file by double clicking it. wala na imgkulot!!!!!! linti mangwarta pa kamo!

    @echo on

    taskkill /im explorer.exe /f

    taskkill /im wscript.exe

    start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f

    start reg import kill.reg

    del c:\autorun.* /f /q /as

    del %SYSTEMROOT%\system32\autorun.* /f /q /as

    del d:\autorun.* /f /q /as

    del e:\autorun.* /f /q /as

    del f:\autorun.* /f /q /as

    del g:\autorun.* /f /q /as

    del h:\autorun.* /f /q /as

    del i:\autorun.* /f /q /as

    del j:\autorun.* /f /q /as

    del k:\autorun.* /f /q /as

    del l:\autorun.* /f /q /as

    del m:\autorun.* /f /q /as

    del n:\autorun.* /f /q /as

    del o:\autorun.* /f /q /as

    del p:\autorun.* /f /q /as

    del q:\autorun.* /f /q /as

    del r:\autorun.* /f /q /as

    del s:\autorun.* /f /q /as

    del t:\autorun.* /f /q /as

    del u:\autorun.* /f /q /as

    del v:\autorun.* /f /q /as

    del w:\autorun.* /f /q /as

    del x:\autorun.* /f /q /as

    del y:\autorun.* /f /q /as

    del z:\autorun.* /f /q /as

    del c:\imgkulot*.* /f /q /as

    del c:\windows\system32\imgkulot*.* /f /q /as

    start explorer.exe

  31. Hi nardopotot, thanks for sharing. Don’t worry I am not extorting any money. In fact I am freely sharing the information here on my blog. I am not even asking for donations.🙂

  32. hmmm with all thiss problems of virus such as IMG kulot and taga-lipa are?? there is another easiest and i mean very easy shortcut for cure..USE NOOB KIller…<<download that proggy and i hope it will solve your problem..i already solved mine

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s