Mhmmmmm Full Post View | List View

I am here to share my moments and to watch your's

WORM_CONDOWN.A Manual Removal Instruction.

Activity

Mainly these virus files reside in root drive and system32 folder. It’s using Autorun facility and once it’s activated automatically moving to multiple locations and running in 2 different names. It will kill almost all anti virus services and modify the registry to deny future running of AV services. The other modification in Registry will deny Show all hidden files option permanently.

Removal Instruction

Win XP /2000

Restart the PC and go to Safe mode Command Prompt. (Press F8 before booting)

Use attrib command to reset the files flag to not hidden, not system, archive.

Use type command to read autorun.inf and note the file name. Reset the flag of same file and then delete. Type regedit in command prompt and browse the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Delete the values which pointing to wnta.exe and lgwubrw.exe.

Delete the same files from system32 directory.

Browse the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options

And then find the sub key related to antivirus name, just delete it. (eg:,nod32.exe, nod32krn.exe)

That’s it.

Tags: virusalert

Wednesday June 20, 2007 - 12:26pm (PDT) Permanent Link | 0 Comments

Entry for January 18, 2007

2007 Syarted with Good Newses...........Jan 17th.......

Thursday January 18, 2007 - 09:41am (PST) Permanent Link | 0 Comments

Wishing you allllllllllll

Merry X' Mas and Prosperous New year to All of You
Maneesh

Thursday December 21, 2006 - 07:50am (PST) Permanent Link | 0 Comments

Entry for November 26, 2006

Hey just was thru a short trip. Round around Native, Delhi, Dubai. and back to base now.

Just a Biz trip. nothing fun..........

Sunday November 26, 2006 - 09:54pm (PST) Permanent Link | 0 Comments

Entry for September 19, 2006

long time nothing comes up huh..... Actually was thru tight schedules...now bit free , will try to bring new updates soon till

 then signing off Monu