Remove Lehs. Description and removal instructions

Lehs manual removal:

Kill processes:
backup.exe, bin.exe, dage.exe, gadeth.exe, kern16.exe, kernel32.exe, microcorp.exe, micropackage.exe, msiinstall.exe, msishell.exe, mtk.exe, ndad.exe, notepad.exe, patch.exe, patch[X].exe, reinstall.exe, restoreshell.exe, shell.exe, splinter.exe, win-16_bit.exe, wincom.exe, windows.exe
Delete files:
backup.exe, bin.exe, dage.exe, gadeth.exe, kern16.exe, kernel32.exe, microcorp.exe, micropackage.exe, msiinstall.exe, msishell.exe, mtk.exe, ndad.exe, notepad.exe, patch.exe, patch[X].exe, reinstall.exe, restoreshell.exe, shell.exe, splinter.exe, win-16_bit.exe, wincom.exe, windows.exe, msdos_3.bat
Delete directories:
C:\Windows\System\Sysrestore
C:\Windows\System32\Sysrestore
C:\[random name]
Misc:
[X] is a set of random characters and digits.

Lehs modifies essential configuration files of Windows 95/98/ME systems. Open the win.ini and system.ini files located in C:\Windows\System or C:\Windows\System32 folder and delete the following lines:
run=C:\Windows\System\Sysrestore\shell.exe
run=C:\Windows\System32\Sysrestore\shell.exe
run=C:\Windows\System\Sysrestore\notepad.exe
run=C:\Windows\System32\Sysrestore\notepad.exe

Locate the autoexec.bat file (it usually can be found in the root of the main hard disk - C:) and delete the following lines:
start C:\Windows\System\Sysrestore\notepad.exe
start C:\Windows\System32\Sysrestore\notepad.exe