|
HOW TO REMOVE W32.Pykspa.D:
1. Temporarily Disable System Restore (Windows Me/XP).
[how to]
2. Remove all the entries that the risk added to the hosts file.
a) Navigate to the following location:
for Windows 95/98/Me:
%Windir%
for Windows NT/2000/XP:
%Windir%\System32\drivers\etc
b) Double-click the hosts file.
c) If necessary, deselect the "Always use this program to open this
program" check box.
d) Scroll through the list of programs and double-click Notepad.
e) When the file opens, delete all the entries added by the risk. See
sample of
Clean Windows Hosts File
f) Close Notepad and save your changes when prompted.
3. Update the virus definitions.
4. Reboot computer in SafeMode
[how to]
5. Run a full system scan and clean/delete all infected file
6. Delete/Modify any values added to the registry.
[how to
edit registry]
Navigate to and delete the following entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
\"Services Start" = "mshtmldat32.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\"Windows Sys" = "explorer.exe mshtmldat32.exe"
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
\"Logon Settings" = "mshtmldat32.exe
Navigate to and delete the following registry subkey:
HKEY_LOCAL_MACHINE\SOFTWARE\RMX\cfg
7. Exit registry editor and restart the computer.
8. In order to make sure that threat is
completely eliminated from your computer, carry out a full scan of your
computer using
AntiVirus and
Antispyware Software. Another way to delete the virus using various
Antivirus Program without the need to install can be done with
Online Virus
Scanner.
|
