Remove W32.Randex.J. Description and removal instructions

Title: W32.Randex.J
Type: Worms	Severity scale: (60 / 100)

W32.Randex.J is a network-aware worm that will copy itself as c$winntsystem32spolds.exe The worm receives instructions from an IRC channel on a specific IRC server. One such command will trigger it to spread itself across the network.

FORUM:
Discuss W32.Randex.J in
spyware removal forum

W32.Randex.J properties:
• Allows remote user connection
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic W32.Randex.J removal:

remover for W32.Randex.J

W32.Randex.J manual removal:

Delete registry values:
Browse to the key:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
Delete the value ''helpmanager' = %System%\spoler.exe'
Browse to the key:
'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices'
Delete the value ''helpmanager' = %System%\spoler.exe'

HELP:
how to remove registry entries

Other programs to remove W32.Randex.J:

• SUPERAntiSpyware - Review - Download
• CounterSpy - Review - Download
• Windows Defender - Review - Download

Information added: 19/03/04
Information updated: 06/03/05

Additional resources related to W32.Randex.J:

Attention: If you know or you have a website or page about W32.Randex.J removal, feel free to add a link to this list: add url

more resources

Post Comment:

Attention: Use this form only if you have additional information about W32.Randex.J parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Comments from visitors:

1. re: comment about W32.Randex.J by Gail Pickard. 2005-03-06 13:03:59

A friend of mine got a virus that is effecting their computer. It has attached itself to C:WinnTsystem32svhost.exe.
Is this the same as the W32.Randex.J Blog? Do we use the same removal method?