W32.Nimda.J@mm manual removal:
Kill processes:
unins000.exe VDoca582.exe
Delete registry values:%UserProfile%HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ??Virus Doctor??
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Virus Doctor_is1
%UserProfile%HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform ??URVDoc[]??
Unregister DLLs:mozcrt19.dll sqlite3.dll
Delete files:c:\\Documents and Settings\\All Users\\Application Data\\927e c:\\Documents and Settings\\All Users\\Application Data\\927e\\unins000.dat c:\\Documents and Settings\\All Users\\Application Data\\927e\\Languages c:\\Documents and Settings\\All Users\\Application Data\\System Data Configuration\\config.cfg c:\\Documents and Settings\\All Users\\Application Data\\System Data Configuration\\DB.ini c:\\Documents and Settings\\All Users\\Application Data\\System Data Configuration\\fsvd6398.db %UserProfile%\\Application Data\\Virus Doctor %UserProfile%\\Application Data\\Virus Doctor\\settings.ini %UserProfile%\\Application Data\\Virus Doctor\\uill.ini %UserProfile%\\Desktop\\Virus Doctor.lnk %UserProfile%\\Start Menu\\Virus Doctor.lnk %UserProfile%\\Start Menu\\Programs\\Virus Doctor.lnk %UserProfile%\\Application Data\\Microsoft\\Internet Explorer\\Quick Launch\\Virus Doctor.lnk c:\\Documents and Settings\\All Users\\Application Data\\927e\\Languages\\VDDe.lng c:\\Documents and Settings\\All Users\\Application Data\\927e\\Languages\\VDFr.lng c:\\Documents and Settings\\All Users\\Application Data\\927e\\Languages\\VDIt.lng c:\\Documents and Settings\\All Users\\Application Data\\927e\\System Data Configuration c:\\Documents and Settings\\All Users\\Application Data\\927e\\System Data Configuration\\DBInfo.ver c:\\Documents and Settings\\All Users\\Application Data\\927e\\System Data Configuration\\vd952342.bd c:\\Documents and Settings\\All Users\\Application Data\\System Data Configuration
Delete directories:%UserProfile%\Application Data\Virus Doctor\
Post Comment: