Win32 AutoRun Worm-Funny UST scandal worm create a hidden background service (xmss.exe). It copied itself on Local disk and Windows Directory (%Windir%). Terminated “Windows Task Manager”, Windows Command Prompt (DOS-Prompt) & crashed System Internal Process Explorer (procxp.exe).
Files created by this worm
* x:autorun.inf
* x:xmss.exe
* x:Funny UST Scandal.avi.exe
* %Windir%\autorun.inf
* %Windir%\xmss.exe
* %Windir%\Funny UST Scandal.avi.exe
How to remove
1. Disabled System Restore for Temporary - KB 264887
2. Boot Windows in Safe Mode - KB 315222
3. In Windows Safe Mode, Open Windows Registry Editor
Windows Start > Run > Regedit
Browse to the following registry settings
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon\Shell
Replace the value 'explorer.exe, xmss.exe' with 'exporer.exe'
4. Delete all the following files
* C\autorun.inf
* C\xmss.exe
* C\Funny UST Scandal.avi.exe
* X:\autorun.inf
* X:\xmss.exe
* X:\Funny UST Scandal.avi.exe
* %Windir%\autorun.inf
* %Windir%\xmss.exe
* %Windir%\Funny UST Scandal.avi.exe
5. Clean All Windows Temporary Files
6. Restart the Windows
** edit registry values with false data can damage your OS **
1 comment:
Protect my computer and eliminate the bugs and viruses.
When you are searching for a great scan that can help you keep your computer running like new, I would suggest that you visit http://www.Search-and-destroy.com. Here I found the antispyware solution from Search-and-destroy and it was exactly what I needed to protect my computer and eliminate the bugs and viruses that would make it run slow, freeze up and shut down. Search-and-destroy Antispyware was the answer to my computer bug problems and it was certainly worth every penny I spent to have this great antispyware to protect my PC. Not only does it work great but it cost less than many of the other scans available.
Post a Comment