WORM_AUTORUN.IAS

To delete the registry key this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies
3. Still in the left panel, locate and delete the key:
   explorer
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>explorer
5. Still in the left panel, locate and delete the key:
   run
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options
7. Still in the left panel, locate and delete the key:
   360rpt.EXE
8. Again Still in the left panel, locate and delete the key:
   360safe.EXE
9. Again Still in the left panel, locate and delete the key:
   360tray.EXE
10. Again Still in the left panel, locate and delete the key:
    360safebox.EXE
11. Again Still in the left panel, locate and delete the key:
    safeboxTray.EXE
12. Again Still in the left panel, locate and delete the key:
    AVP.EXE
13. Again Still in the left panel, locate and delete the key:
    AVP.COM
14. Again Still in the left panel, locate and delete the key:
    AvMonitor.EXE
15. Again Still in the left panel, locate and delete the key:
    CCenter.EXE
16. Again Still in the left panel, locate and delete the key:
    IceSword.EXE
17. Again Still in the left panel, locate and delete the key:
    Iparmor.EXE
18. Again Still in the left panel, locate and delete the key:
    KVMonxp.KXP
19. Again Still in the left panel, locate and delete the key:
    KVSrvXP.EXE
20. Again Still in the left panel, locate and delete the key:
    KVWSC.EXE
21. Again Still in the left panel, locate and delete the key:
    Navapsvc.EXE
22. Again Still in the left panel, locate and delete the key:
    Nod32kui.EXE
23. Again Still in the left panel, locate and delete the key:
    nod32krn.EXE
24. Again Still in the left panel, locate and delete the key:
    KRegEx.EXE
25. Again Still in the left panel, locate and delete the key:
    Frameworkservice.EXE
26. Again Still in the left panel, locate and delete the key:
    Mmsk.EXE
27. Again Still in the left panel, locate and delete the key:
    Ast.EXE
28. Again Still in the left panel, locate and delete the key:
    WOPTILITIES.EXE
29. Again Still in the left panel, locate and delete the key:
    Regedit.EXE
30. Again Still in the left panel, locate and delete the key:
    AutoRunKiller.EXE
31. Again Still in the left panel, locate and delete the key:
    VPC32.EXE
32. Again Still in the left panel, locate and delete the key:
    VPTRAY.EXE
33. Again Still in the left panel, locate and delete the key:
    ANTIARP.EXE
34. Again Still in the left panel, locate and delete the key:
    KASARP.EXE
35. Again Still in the left panel, locate and delete the key:
    RAV.EXE
36. Again Still in the left panel, locate and delete the key:
    kwatch.EXE
37. Again Still in the left panel, locate and delete the key:
    kmailmon.EXE
38. Again Still in the left panel, locate and delete the key:
    kavstart.EXE
39. Again Still in the left panel, locate and delete the key:
    KAVPFW.EXE
40. Again Still in the left panel, locate and delete the key:
    Runiep.EXE
41. Again Still in the left panel, locate and delete the key:
    GuardField.EXE
42. Again Still in the left panel, locate and delete the key:
    GFUpd.EXE
43. Again Still in the left panel, locate and delete the key:
    rfwmain.EXE
44. Again Still in the left panel, locate and delete the key:
    RavStub.EXE
45. Again Still in the left panel, locate and delete the key:
    rfwstub.EXE
46. Again Still in the left panel, locate and delete the key:
    rfwProxy.EXE
47. Again Still in the left panel, locate and delete the key:
    rfwsrv.EXE
48. Again Still in the left panel, locate and delete the key:
    msconfig.EXE
49. Again Still in the left panel, locate and delete the key:
    SREngLdr.EXE
50. Again Still in the left panel, locate and delete the key:
    ArSwp.EXE
51. Again Still in the left panel, locate and delete the key:
    RSTray.EXE
52. Again Still in the left panel, locate and delete the key:
    QQDoctor.EXE
53. Again Still in the left panel, locate and delete the key:
    TrojanDetector.EXE
54. Again Still in the left panel, locate and delete the key:
    Trojanwall.EXE
55. Again Still in the left panel, locate and delete the key:
    TrojDie.KXP
56. Again Still in the left panel, locate and delete the key:
    PFW.EXE
57. Again Still in the left panel, locate and delete the key:
    HijackThis.EXE
58. Again Still in the left panel, locate and delete the key:
    AutoRun.EXE
59. Again Still in the left panel, locate and delete the key:
    KPfwSvc.EXE
60. Again Still in the left panel, locate and delete the key:
    kissvc.EXE
61. Again Still in the left panel, locate and delete the key:
    kav32.EXE
62. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>explorer>run
3. In the right panel, locate and delete the entry:
   internetnet = "%System%\spoolsv.exe"
4. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360rpt.EXE
5. In the right panel, locate and delete the entry:
   debugger = "%System%\dllcache\spoolsv.exe"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360safe.EXE
7. In the right panel, locate and delete the entry:
   debugger = "%System%\dllcache\spoolsv.exe"
8. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360tray.EXE
9. In the right panel, locate and delete the entry:
   debugger = "%System%\dllcache\spoolsv.exe"
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>360safebox.EXE
11. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
12. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>safeboxTray.EXE
13. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
14. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AVP.EXE
15. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AVP.COM
17. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
18. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AvMonitor.EXE
19. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
20. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>CCenter.EXE
21. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
22. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>IceSword.EXE
23. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
24. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Iparmor.EXE
25. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
26. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVMonxp.KXP
27. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
28. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVSrvXP.EXE
29. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
30. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KVWSC.EXE
31. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
32. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Navapsvc.EXE
33. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
34. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Nod32kui.EXE
35. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
36. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>nod32krn.EXE
37. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
38. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KRegEx.EXE
39. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
40. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Frameworkservice.EXE
41. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
42. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Mmsk.EXE
43. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
44. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Ast.EXE
45. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
46. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>WOPTILITIES.EXE
47. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
48. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Regedit.EXE
49. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
50. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AutoRunKiller.EXE
51. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
52. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>VPC32.EXE
53. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
54. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>VPTRAY.EXE
55. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
56. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ANTIARP.EXE
57. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
58. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KASARP.EXE
59. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
60. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RAV.EXE
61. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
62. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kwatch.EXE
63. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
64. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kmailmon.EXE
65. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
66. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kavstart.EXE
67. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
68. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KAVPFW.EXE
69. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
70. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Runiep.EXE
71. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
72. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>GuardField.EXE
73. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
74. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>GFUpd.EXE
75. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
76. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwmain.EXE
77. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
78. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RavStub.EXE
79. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
80. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwstub.EXE
81. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
82. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwProxy.EXE
83. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
84. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>rfwsrv.EXE
85. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
86. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>msconfig.EXE
87. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
88. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>SREngLdr.EXE
89. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
90. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>ArSwp.EXE
91. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
92. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>RSTray.EXE
93. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
94. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>QQDoctor.EXE
95. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
96. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojanDetector.EXE
97. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
98. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>Trojanwall.EXE
99. In the right panel, locate and delete the entry:
    debugger = "%System%\dllcache\spoolsv.exe"
100. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>TrojDie.KXP
101. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
102. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>PFW.EXE
103. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
104. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>HijackThis.EXE
105. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
106. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>AutoRun.EXE
107. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
108. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>KPfwSvc.EXE
109. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
110. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kissvc.EXE
111. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
112. In the left panel, double-click the following:
     HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Image File Execution Options>kav32.EXE
113. In the right panel, locate and delete the entry:
     debugger = "%System%\dllcache\spoolsv.exe"
114. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista and 7:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Explorer>Advanced>Folder>Hidden>SHOWALL
3. In the right panel, locate the registry value:
   CheckedValue = "2"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   CheckedValue = "1"
5. Close Registry Editor.

To manually delete a malware/grayware component from an affected system:

• For Windows 2000, Windows XP, and Windows Server 2003:

1. Right-click Start then click Search....
2. In the Named input box, type:
   
   • %System Root%\AUTORUN.INF
   • %Program Files%\ccdd.pif
   • %System Root%\Documents and Settings\11.pif
   • %System Root%\Documents and Settings\22.pif
   • %System Root%\Documents and Settings\33.pif
   • %System Root%\Documents and Settings\4.pif
   • %System Root%\Documents and Settings\5.pif
   • %System Root%\Documents and Settings\66.pif
   • %System Root%\Documents and Settings\7.pif
   • %System Root%\Documents and Settings\8.pif
   • %System Root%\Documents and Settings\99.pif
   • %System Root%\Documents and Settings\1010.pif
   • %System%\aktwkss.dll
3. In the Look In drop-down list, select My Computer then press Enter.
4. Once located, select the file then press SHIFT+DELETE to delete it.
5. Repeat the said steps for all files listed.

• For Windows Vista and Windows 7 users:

1. Click Start>Computer.
2. In the Search input box, type:
   
   • %System Root%\AUTORUN.INF
   • %Program Files%\ccdd.pif
   • %System Root%\Documents and Settings\11.pif
   • %System Root%\Documents and Settings\22.pif
   • %System Root%\Documents and Settings\33.pif
   • %System Root%\Documents and Settings\4.pif
   • %System Root%\Documents and Settings\5.pif
   • %System Root%\Documents and Settings\66.pif
   • %System Root%\Documents and Settings\7.pif
   • %System Root%\Documents and Settings\8.pif
   • %System Root%\Documents and Settings\99.pif
   • %System Root%\Documents and Settings\1010.pif
   • %System%\aktwkss.dll
3. Once located, select the file then press SHIFT+DELETE to delete it.
4. Repeat the said steps for all files listed.
   *Note: Read the following Microsoft page if these steps do not work on Windows 7.