Remove Burmec. Description and removal instructions

 
Title: Burmec

Type: Worms
Severity scale:Burmec severity is 57  (57 / 100)
 
Burmec is a worm that spreads by copying itself to removable media, local hard disks and mapped network drives. Once executed, the parasite displays a picture and installs itself to the system. Then it runs a spreading routine and a payload. Burmec modifies some system settings and disables essential system tools such as Registry Editor, Command Prompt and Task Manager. It also terminates some running antivirus programs. Furthermore, the worm can corrupt local files or replace them with copies of itself. Burmec automatically runs on every Windows startup and every time applications are being launched or files of certain types are being opened.


Related files: CMD.exe, explorer.exe, MSCONFIG.EXE, regedit.exe, regwiz.exe, SCANREGW.EXE, sfc.exe, taskmgr.exe, wscript.exe, command.com, minigame.com, msgsrv16.com, sndvol32.com, rpcsx.vdx, cirsx.oxc, sndvol32.oxc

Burmec properties:
• Hides from the user
• Stays resident in background

Automatic Burmec removal:

remover for Burmec

Burmec manual removal:

Kill processes:
cmd.exe, explorer.exe, msconfig.exe, regedit.exe, regwiz.exe, scanregw.exe, sfc.exe, taskmgr.exe, wscript.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell=explorer.exe msgsrv16.com
HKEY_CLASSES_ROOT\batfile\Shell\Open\Command\(Default)=%System%\cirsx.oxc "%1" %*
HKEY_CLASSES_ROOT\comfile\Shell\Open\Command\(Default)=%System%\cirsx.oxc "%1" %*
HKEY_CLASSES_ROOT\exefile\Shell\Open\Command\(Default)=C:\Recycled\kernel.vdx "%1" %*
HKEY_CLASSES_ROOT\exefile\Shell\RunAs\Command\(Default)=%Windir%\msgsrv16.com
HKEY_CLASSES_ROOT\File\Shell\Open\Command\(Default)=%Windir%\msgsrv16.com
HKEY_CLASSES_ROOT\lnffile\Shell\Open\Command\(Default)=%System%\rpcsx.vdx
HKEY_CLASSES_ROOT\nffile\Shell\Open\Command\(Default)=%Windir%\msgsrv16.com
HKEY_CLASSES_ROOT\piffile\Shell\Open\Command\(Default)=%System%\cirsx.oxc "%1" %*
HKEY_CLASSES_ROOT\scrfile\Shell\Open\Command\(Default)=C:\Recycled\kernel.vdx "%1" %*
HKEY_CLASSES_ROOT\*\Shell\OpenAs\Command\(Default)=%Windir%\msgsrv16.com
HKEY_CLASSES_ROOT\*\shellex\OpenWith\Command\(Default)=%System%\sndvol32.oxc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Network\DisablePwdCaching=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\Disabled=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp\NoRealMode=1
Delete files:
cmd.exe, explorer.exe, msconfig.exe, regedit.exe, regwiz.exe, scanregw.exe, sfc.exe, taskmgr.exe, wscript.exe, command.com, minigame.com, msgsrv16.com, sndvol32.com, rpcsx.vdx, cirsx.oxc, sndvol32.oxc
Misc:
Exact file location:
kernel.vdx - C:\Recycled
minigame.com, msgsrv16.com - C:\Windows or C:\Winnt
rpcsx.vdx, cirsx.oxc, sndvol32.oxc - C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32

Files cmd.exe, explorer.exe, msconfig.exe, regedit.exe, regwiz.exe, scanregw.exe, sfc.exe, taskmgr.exe, wscript.exe, command.com and sndvol32.com can be found on removable medias, local hard disks and mapped network drives.

Other programs to remove Burmec:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 06/10/06
Information updated: 06/10/06

Additional resources related to Burmec:

Attention: If you know or you have a website or page about Burmec removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Burmec parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:

Latest spyware news:
Similar parasites: