WORM_PALEVO.AC

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon
3. In the right panel, locate and delete the entry:
   Taskman = %System Root%\RECYCLER>S-1-5-21-5059404795-7200954227-027620795-4397>nissan.exe
4. Close Registry Editor.

To delete malware/grayware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   %system root%\RECYCLER
   %system root%\RECYCLER\S-1-5-21-5059404795-7200954227-027620795-4397
   {removable drive}\ELITNAJED
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat the said steps for all folders listed.

To identify and delete AUTORUN.INF files created:

1. Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   AUTORUN.INF
3. In the Look in: drop-down list, select a drive, then press Enter.
4. Select the file, then open using Notepad.
5. Check if the following lines are present in the file:
   [autorun
   ;{garbage}
   ;{garbage}
   open=ELITNAJED///jedinica.exe
   
   ;{garbage}
   icon=%SystemRoot%\system32\SHELL32.dll,4
   ;{garbage}
   
   action=Open folder to view files using Windows Explorer
   ;{garbage}
   
   Shell\open\\command=ELITNAJED///jedinica.exe
   ;{garbage}
   
   shell\explore\command=ELITNAJED///jedinica.exe
   ;{garbage}
   
   USEAUTOPLAY=1
   :AH WHAT CAN I SAY
6. If the lines are present, delete the file.
7. Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
8. Close Search Results.