 Remove W32.Patoo. Description and removal instructions
The email looks like this: Subject: hey.. Attachment: Stop Messenger Popups Note: While the attachment name is displayed as Stop Messenger Popups, the attachment is actually the original filename (most likely msngrblock.exe) of the worm. This is accomplished by modifying the label of the attachment in an attempt to deceive the recipient. W32.Patoo properties: • Allows remote user connection • Hides from the user • Stays resident in background Automatic W32.Patoo removal:remover for W32.Patoo
W32.Patoo manual removal:Delete registry values:Browse to the key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' Delete the value: 'Messenger Block'='C:\windows\msngrblock.exe' Browse to the key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunServices' Delete the value: 'Messenger Block'='C:\windows\msngrblock.exe' Browse to the key: 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ RunOnce' Delete the value: 'Messenger Block'='C:\windows\msngrblock.exe' Browse to the key: 'HKEY_CLASSES_ROOT\exefile\shell\open\command' Replace current value with this: '%1' %* Browse to the key: 'HKEY_CLASSES_ROOT\comfile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_CLASSES_ROOT\batfile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_CLASSES_ROOT\htafile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_CLASSES_ROOT\piffile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_LOCAL_MACHINE\Software\CLASSES\htafile\shell\open\command\' Replace current value with this: '%1' %* Browse to the key: 'HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\open\command\' Replace current value with this: '%1' %* Other programs to remove W32.Patoo:• Malwarebytes Anti Malware - Review - Download• Malwarebytes Anti Malware - Review - Download • Windows Defender - Review - Download Information added: 19/03/04 Information updated: 09/04/04 Additional resources related to W32.Patoo:Attention: If you know or you have a website or page about W32.Patoo removal, feel free to add a link to this list: add url
more resources Post Comment:Attention: Use this form only if you have additional information about W32.Patoo parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.
|
Latest spyware news:
 What makes your computer run slowly? Major malicious websites registrar shutting down on November 24 AVG staff sliped once again Critical Windows file labeled as malicious by AVG Anti-Virus Obama – the favorite theme for spam and malware Common mistakes that jeopardize computer security Fake porn video websites distributing malware Browser hijackers become more frequent threat PDF documents on target Time for vengeance: AntiVirus XP distributors suedSubscribe to news 
Similar parasites:
|
FORUM:
HELP:
