Remove W32.Rontokbro.B@mm

A few steps to Remove W32.Rontokbro.B@mm

1. Disable System Restore (Windows Me/XP).

2. Restarted your computer in Safe mode

3. In safe mode run xp_secconsole.exe and in Windows explorer > uncheck
Disable Folder Options then in System Security > uncheck Disable
Regedit after that exit that application.

xp_secconsole.exe can be download from
http://www.dougknox.com/xp/utils/xp_secconsole.zip

4. Delete the following files:

%UserProfile%\Local Settings\Application Data\csrss.exe
%UserProfile%\Local Settings\Application Data\inetinfo.exe
%UserProfile%\Local Settings\Application Data\lsass.exe
%UserProfile%\Local Settings\Application Data\services.exe
%UserProfile%\Local Settings\Application Data\smss.exe
%UserProfile%\Local Settings\Application Data\winlogon.exe
%UserProfile%\Start Menu\Programs\Startup\Empty.pif
%UserProfile%\Templates\A.kotnorB.com
%Windir%\inf\norBtok.exe
%System%\3D Animation.scr

Note:
%System% is a variable that refers to the System folder. By default
this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32
(Windows NT/2000), or C:\Windows\System32 (Windows XP).
%Windir% is a variable that refers to the Windows installation folder.
By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\Winnt
(Windows NT/2000).
%UserProfile% is a variable that refers to the current user’s profile
folder. By default, this is C:\Documents and Settings\[CURRENT USER]
(Windows NT/2000/XP).

Delete the directory:

%UserProfile%\Local Settings\Application Data\Bron.tok-3-3

5. delete the scheduled tasks added by the worm

Click Start, and then click Control Panel. (In Windows XP, switch to
Classic View.)
In the Control Panel window, double click Scheduled Tasks.
Right click the task icon and select Properties from pop-up menu.
The properties of the task is displayed.
Delete the task if the contents of the Run text box in the task pane,
matches the following:

%UserProfile%\Templates\A.kotnorB.com

Note that if you use removable storage media, it’s sure that device
will be with that virus. So what you can do is here. Folder Options >
click View All file and folder and Click System file and folder. And
view your device there will be some virus files in your device. Just
give them SHIFT + DELETE. There you go, happy, your system is clean
now. Thanks for reading this.


Sursa
2009-01-31 16:31:26



Comenteaza





Ultimele 25 posturi adăugate

21:33:07Apply for the 2020 edition of the European Charlemagne Youth Prize —» Informaţii pentru studenţi !
21:33:04THE BLUE BOOK TRAINEESHIP —» Informaţii pentru studenţi !
15:30:23MAIA SANDU, ȘANSA LUI DODON —» Nicolae Federiuc
14:50:46Să îi urăm ”La mulți ani” Regelui umorului moldovenesc, Gheorghe Urschi —» Elena Robu
14:10:39Zelenski nu va semna cererea de demisie a premierului ucrainean —» Elena Robu
12:12:06Stop torturii la închisoare! Protest la ANP —» Curaj.TV | Media alternativă
11:59:51The Albion Territory приглашает всех на день своего ВозРождения! —» Заметки Начинающего Журналиста
11:57:29Ucraina în limba română: Discursul lui Putin și impactul asupra Ucrainei —» Curaj.TV | Media alternativă
09:21:06Brand Electronic cigarettes online shop, ecigs at CigaBuy —» Informaţii pentru studenţi !
09:21:04Floryday: Sale!up to 80% - 85% off+ship within 24 hours —» Informaţii pentru studenţi !
08:33:45Consiliul Local al Tinerilor din Mileștii Mici își reia activitatea într-o nouă componență —» Forţa Tinerilor | Organizaţie nonguvernamentală
07:55:20Kenmore Ultra Wash Dishwasher Model 665 —» Andrei Fornea
06:09:56Brand Electronic cigarettes online shop, ecigs at CigaBuy —» plop andrei
05:30:18Floryday: Sale!up to 80% - 85% off+ship within 24 hours —» plop andrei
21:12:09Hostinger Web Hosting | Starting at $0.80/mo‎ —» Informaţii pentru studenţi !
21:12:07The best offers to Europe and the best offers to Portugal —» Informaţii pentru studenţi !
20:38:42Încă o anonimă despre situaţia din penitenciarele moldoveneşti —» Curaj.TV | Media alternativă
20:23:35Hostinger Web Hosting | Starting at $0.80/mo‎ —» plop andrei
19:51:01The best offers to Europe and the best offers to Portugal —» plop andrei
19:22:36Peste 25 ani a venit să ceară banii de la cununia fetei —» Curaj.TV | Media alternativă
19:00:47©️ Cicatrici —» Licurici de suflet
18:58:35United in Peace —» Liceul Teoretic “Mihail Sadoveanu”, Călăraşi
16:18:48România ne construiește grădiniţe, iar moldovenii votează cu Rusia —» Elena Robu
15:42:59Republica Moldova între optimism și neputință —» Elena Robu
15:00:24Nu fi lăudăros | Pastor Vasile Filat —» Moldova Creștină