Make sure you read, copy, and print out the
Solution: <<Located in that link I gave you, scroll down the page..
Identifying the Malware Program
Before proceeding to remove this malware, first identify the malware program.
Scan your system with Trend Micro antivirus and NOTE all files detected as WORM_MORB.A. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's free online virus scanner.
Terminating the Malware Program
This procedure terminates the running malware process from memory. You will need the name(s) of the file(s) detected earlier.
Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file or files detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On systems running Windows 95/98/ME, Task Manager may not show certain processes. You may use a third party process viewer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing during startup.
Important: Trend Micro advises users to take extra precaution while editing the registry. Any error made while editing the registry may adversely affect system configuration and may even require you to reinstall your operating system. Please consult the following articles from Microsoft for more information about the registry and the registry editor:
About the Registry and How to Use Registry Editor
HOW TO: Backup, Edit, and Restore the Registry in Windows 95, Windows 98, and Windows Me
HOW TO: Backup, Edit, and Restore the Registry in Windows NT 4.0
HOW TO: Back Up, Edit, and Restore the Registry in Windows XP
HOW TO: Backup, Edit, and Restore the Registry in Windows 2000
To remove the malware autostart entries:
Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries:
svchost = "C:\WINDOWS\svchost.exe"
WinSyst32 = "winsyst32.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry or entries:
WinSyst32="winsyst32.exe"
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunServices
In the right panel, locate and delete the entry or entries:
WinSyst32 = winsyst32.exe
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries:
svchost = "%WINDOWS%\svchost.exe"
"%WINNT%\svchost.exe"
WinSyst32 = "winsyst32.exe"
In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry or entries:
WinSyst32 = "winsyst32.exe"
In the left panel, double-click the following:
HKEY_USERS>.Default>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry or entries:
svchost = "%WINDOWS%\svchost.exe" or "%WINNT%\svchost.exe" WinSyst32 = "winsyst32.exe"
In the left panel, double-click the following:
HKEY_USERS>.Default>Software>Microsoft>
Windows>CurrentVersion>RunOnce
In the right panel, locate and delete the entry or entries:
WinSyst32 = "winsyst32.exe
Close Registry Editor.
NOTE: If you were not able to terminate the malware process from memory as described in the previous procedure, restart your system.
Restoring MIRC.INI
Check the MIRC.INI load value and remove the malware application file if present.
Look for the MIRC.INI file in your hard drive.
Locate for “[rfiles]” and check if the application file name refer to MScript.ini as follows:
[rfiles]
n(no.)=MScript.ini
Delete MScript.ini.
Running Trend Micro Antivirus
Scan your system with Trend Micro antivirus and delete all files detected as WORM_MORB.A. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro’s free online virus scanner.
