If you meet this virus, your computer has file 'database.mdb' in My Documents. Your computer is also running 'wscript.exe' application in your background process, see the task manager by press [CTRL]+[ALT]+[DEL] to see the application process that running in your PC. This virus is also making cuplicate of every folders and making two fake folders titled "Harry Potter and….lnk" and "Microsoft.Ink".
This virus moves faster because it makes autorun.inf in every drives, folders, and even USB that you've plug in.
To remove this virus, you need to turn off 'System Restore' (Left Click on My Computer), and do end process of 'wscript.exe', you can use Process Explorer or HijackThis to do this. Delete 'database.mdb' in My Documents. Don't forget to remove all duplicate fake folders by using Windows Search in "More Advanced Option" mode, and mark "Search System Folders" and "Search Hidden Files and Folders" options, then do search with name "autorun.inf" with 8 KB of size, "Thumb.db" with 8 KB of size, and
Extension ".Ink" with 1 KB of size. And the last step is by removing registry which has "HKCU\Software\Microsoft\Windows\CurrentVersion\Run:***" , the *** shows the file that related to the virus, like 'database.mdb', 'wscript.exe', or else.
