Removal of Worm.

kirstyreanne

My friends got a worm on his computer (didn't have anti-virus software on it). It's the W32.Alcarys.B@mm virus.

I've been recommended to uninstall XP & then re-install it to be sure but not sure how to do it. Could anyone please give me some tips.

Also will this be enough to remove the virus or is it best for me to run some other program first to get rid of it before I uninstall xp?

Thanks in advance

T4i

If you format (re-install windows) you will loose everything on your p.c including the virus/worm.

You can try these steps first to manualy remove the worm.

Delete all files detected as W32.Alcarys.B@mm

remove the value:
"Rundll64" = "c:\windows\rundll64.exe"
from the registry key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices"

remove the values:
"Windows Update" = "C:\WINDOWS\Start Menu\Programs\Windows Update\file###.###.exe"
"Regedit" = "C:\windows\regedit.exe"
from the registry key:
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"

restore the default value for the registry keys:
"HKEY_CLASSES_ROOT\mp3file\shell\open\command"
"HKEY_CLASSES_ROOT\VBSFile\Shell\Open\Command"
"HKEY_CLASSES_ROOT\VBSFile\Shell\Open2\Command"
"HKEY_CLASSES_ROOT\mp3file\shell\play\command"
"HKEY_CLASSES_ROOT\JSFile\Shell\Open\Command"
"HKEY_CLASSES_ROOT\JSFile\Shell\Open2\Command"
"HKEY_CLASSES_ROOT\txtfile\shell\open\command"

remove the values:
"*Windows" = "c:\windows\windows.exe"
and
"MSMSGS" = "c:\msmsgs.exe"
from the registry key:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"


To do this you will need to make sure all files and folders are shown. You will need to turn system restore off and possibly carry this out in safe mode.

You will also need to delete sections of the registry. Typing regedit into the run command alows this, be very careful messing with the registry. Follow the instructions very carefuly.

heatherw_01

If you follow T4i's steps to remove the worm, make sure your friend gets an antivirus and does a scan and you can also use the free online scan at www.housecall.trendmicro.com

T4i

A very good anti-virus package:-

http://files.avast.com/iavs4pro/setupeng.exe

Avast Home Edition - 60 Day Trial. Getting very good reports, it may get rid of the worm for you.

peter_the_piper

And tell him to be very careful which e-mails he opens. this virus often comes via those strange one word e-mails, delete them without opening.

kirstyreanne

Thank you loads.

Looks like I got a busy night ahead of me!

T4i

kirstyreanne wrote:

My friends got a worm on his computer (didn't have anti-virus software on it). It's the W32.Alcarys.B@mm virus.

Your friend has opened an email with the subject "sounds of sex and other stuffs" :rotfl: :rotfl: :rotfl:

Cool! :beer:

robnye

T4i wrote:

Your friend has opened an email with the subject "sounds of sex and other stuffs" :rotfl: :rotfl: :rotfl:

Cool! :beer:

how do you know that........

T4i

I sent it

Rex_Mundi

A very good anti-virus package:-

http://files.avast.com/iavs4pro/setupeng.exe

Avast Home Edition - 60 Day Trial. Getting very good reports, it may get rid of the worm for you.

Avast Home Edition is completely free for home users. All you have to do is register your copy. I've installed this on one of the home computers and am quite impressed with it.

WARNING

Do not install it if you already have an antivirus. Running two together could cause more problems than you already have.

ukbill69

try http://www.norton.com/ they offer free download tools to remove worms and tell you how to do it to. Great site.