WORM_PALEVO.ZQWA

Since this malware uses rootkit technology, detection and removal using normal and safe mode methods may not eliminate it completely. This procedure restarts the system using the Windows Recovery Console.

1. Insert the Windows Installation CD into the CD drive, then Press the restart button.
2. Upon prompt, press any key to boot from the CD.
3. On the main menu, type r to go to the Recovery Console.
4. Type the drive that contains Windows (usually C:) and press Enter.
5. In the input box, type the following then press Enter:
   

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon
3. In the right panel, locate and delete the entry:
   Taskman = %Application Data%\rljlz.exe
4. Close Registry Editor.

To delete malware/grayware component files:

1. Search for the following files:
   
    
   • [DRIVE]:\OBJESI
   
   Note: To do a search for the following files, right-click Start then click Search... or Find..., depending on the version of Windows you are running. For each file to be deleted, type its file name in the Named input box. In the Look In drop-down list, select My Computer, then press Enter.
2. Once located, select the file then press SHIFT+DELETE to permanently delete the file.
3. Repeat the said steps for all files listed.

To identify and delete AUTORUN.INF files created:

1. Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   AUTORUN.INF
3. In the Look in: drop-down list, select a drive, then press Enter.
4. Select the file, then open using Notepad.
5. Check if the following lines are present in the file:
   
   ;{garbage codes}
   [autorun]
   shell\Install\command=OBJESI\sise.exe
   shell\open\command=OBJESI\sise.exe
   shell\explore\command=OBJESI\sise.exe
   Shell\open\command=OBJESI\sise.exe
   useautoplay=1
   shellexecute=OBJESI\sise.exe
   open=OBJESI\sise.exe
   action=Open folder to view files
   icon=shell32.dll,4
6. If the lines are present, delete the file.
7. Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
8. Close Search Results.