Fake UPS Tracking Number Virus: Removal & Fix

Dealing with the Fake UPS Shipping Label Virus

If you or someone you know has experienced a recent infection after inadvertently opening a fraudulent shipping label attachment in an email, a straightforward removal process is available. The following steps proved effective on our test system.

The malicious email typically arrives with an attachment, often named similarly to "UPS_invoice_NR34073.zip," and contains text resembling this:

Dear customer! Delivery of your parcel to the provided address was unsuccessful. The reason for this is an error in the shipping address. You are required to collect the parcel in person from our post office! Please be advised! The shipping label is attached to this email. Kindly print this label to retrieve your package from our post office.

This email delivers a virus that causes the infected computer to repeatedly restart.

Removing the Virus: A Step-by-Step Guide

Fortunately, a relatively quick solution exists. Resolving the Fake UPS Tracking Number Virus Issue. When your computer restarts again, repeatedly press the F8 key just before Windows begins to load. This action will bring up the boot options menu, from which you should select Safe Mode.

After the system boots into Safe Mode, open the Run dialog box. Type "shell:startup" into the box and press Enter. This will directly open the startup folder.

Within the startup folder, locate and delete the file named "raryp32.exe".

You should now be able to restart your computer and regain access to your system. It is crucial to perform a comprehensive virus scan at this stage.

If you do not currently have an anti-virus application installed, we suggest utilizing the free Microsoft Security Essentials.

Please note: The outlined procedure was successful in our testing environment. However, viruses are constantly evolving, and these specific steps may not be effective in all cases.