W32.RONTOKBRO.K removal
procedures requires technical know-how on computer
troubleshooting. It is better to consult your LAN Administrator or
Technical Persons to avoid additional damage on your computer.
MANUAL REMOVAL:
1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Run a full system scan and delete all the files detected.
4. Use the Security Response "Tool
to reset shell\open\command registry subkeys."
5. Delete any values added to the registry.
Navigate to the subkey and delete
value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value: "Bron-Spizaetus" = ""%Windir%\ShellNew\sempalong.exe""
Navigate to the subkey and delete value:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Value: "Tok-Cirrhatus" = "%UserProfile%\Local Settings\Application
Data\smss.exe""
Navigate to the subkey and reset value to default if
required:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Value: "Shell" = "Explorer.exe"
Navigate to the subkey and reset value to default if
required:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Value: "NoFolderOptions" = "0" or "NoFolderOptions" = "1"
Navigate to the subkey and reset values to default
if required:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\explorer\advanced
Values:
"Hidden" = "0" or "Hidden" = "1"
"ShowSuperHidden" = "0" or "ShowSuperHidden" = "1"
"HideFileExt" = "0" or "HideFileExt" = "1"
7. Exit Registry and Restart the computer.
8. Delete the scheduled task.
To delete the scheduled tasks
added by the worm
a. Click Start, and then click Control Panel. (In Windows XP, switch to
Classic View.)
b. In the Control Panel window, double click Scheduled Tasks.
c. Right click the task icon and select Properties from menu. The
properties of the task is displayed.
d. Delete the task if the contents of the Run text box in the task pane,
matches the following:
%UserProfile%\Templates\Brengkolang.com
9. Restart the computer.
10. In order to make sure that w32 rontokbro.k is
completely eliminated from your computer, carry out a full scan of your
computer using
AntiVirus and
Antispyware Software. Another way to delete the virus using various
Antivirus Program without the need to install can be done with
Online Virus
Scanner.
Download and run any of these
Anti-Spyware:
Spy Sweeper
Spyware Doctor
Pest Patrol
Spy Hunter
Click here to download
Click here to
proceed |
