Appflet manual removal:
Kill processes:
installgallery.exe, syspw32.exe, winpw32.exe
Delete registry values:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CLASSES_ROOT\exefile\Shell\Open\Command\(Default)=%Windir%\System\winpw32.exe %1 %*
Delete files:installgallery.exe, syspw32.exe, winpw32.exe, actorsgallery.zip
Misc:The worm may create numerous infected executable files with random names.
The actorsgallery.zip archive arrives attached to Appflet e-mail messages.
Names of installed files and registry entries may vary.
Exact file location:
syspw32.exe - C:\Windows or C:\Winnt
installgallery.exe, winpw32.exe - C:\Windows\System or C:\Winnt\System
Post Comment: