How to Remove Virus
Content
Removing Autostart Entries from the Registry This solution deletes/modifies registry keys/entries added/modified by this malw are. Before performing the steps below, make sure you know how to back up the re gistry and how to restore it if a problem occurs. Refer to this Microsoft articl e for more information about modifying your computer's registry. 1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter. 2. In the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Run 3. In the right panel, locate and delete the entry: Explorer = "Wscript.exe //e:VBScript "%My Documents%\database.mdb" (Note: %My Documents% is usually C:\Windows\Profiles\{user name}\My Docume nts on Windows 98 and ME, C:\WINNT\Profiles\{user name}\Personal, and C:\Documen ts and Settings\{user name}\My Documents on Windows 2000, XP, and Server 2003.) 4. In the left panel, double-click the following: HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft> Windows>CurrentVersion>Run 5. In the right panel, locate and delete the entry: WinUpdate = "Wscript.exe //e:VBScript "%Windows%\:Microsoft Office Update for Windows XP.sys" (Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\ WINNT.) Removing Other Malware Entries from the Registry 1. Still in Registry Editor, in the left panel, double-click the following: HKEY_CURRENT_USER>Software>Microsoft> Windows>CurrentVersion>Policies>System 2. In the right panel, locate and delete the entry: DisableRegistrytools = "1" 3. Close Registry Editor. Deleting Malware-created AUTORUN.INF/s 1. Right-click Start then click Search... or Find..., depending on the versio n of Windows you are running. 2. In the Named input box, type: AUTORUN.INF 3. In the Look In drop-down list, select a drive, then press Enter. 4. Select the file, then open using Notepad. 5. Check if the following lines are present in the file: [autorun] open=WScript.exe //e:VBScript thumb.db auto shell\open=Open shell\open\Command=WScript.exe //e:VBScript thumb.db auto shell\open\Default=1 shell\explore=Explore shell\explore\Command=WScript.exe //e:VBScript thumb.db auto 6. If the lines are present, delete the file. 7. Repeat steps 3 to 6 for AUTORUN.INF files in the remaining removable drive s. 8. Close Search Results. Important Windows ME/XP Cleaning Instructions Users running Windows ME and XP must disable System Restore to allow full scanni ng of infected computers.
Users running other Windows versions can proceed with the succeeding solution se t(s). Running Trend Micro Antivirus If you are currently running in safe mode, please restart your computer normally before performing the following solution. Scan your computer with Trend Micro antivirus and delete files detected as VBS_A UTORUN.BKL. To do this, Trend Micro customers must download the latest virus pat tern file and scan their computer. Other Internet users can use HouseCall, the T rend Micro online virus scanner.
Trend Micro offers best-of-breed antivirus and content-security solutions for yo ur corporate network, small and medium business, mobile device or home PC. For additional information about this threat, see: Overview Technical Details Search a new malware
Users running other Windows versions can proceed with the succeeding solution se t(s). Running Trend Micro Antivirus If you are currently running in safe mode, please restart your computer normally before performing the following solution. Scan your computer with Trend Micro antivirus and delete files detected as VBS_A UTORUN.BKL. To do this, Trend Micro customers must download the latest virus pat tern file and scan their computer. Other Internet users can use HouseCall, the T rend Micro online virus scanner.
Trend Micro offers best-of-breed antivirus and content-security solutions for yo ur corporate network, small and medium business, mobile device or home PC. For additional information about this threat, see: Overview Technical Details Search a new malware
