Solution:
Identifying the Malware Program
Before proceeding to remove this malware, first identify the malware program.
Scan your system with Trend Micro antivirus and NOTE all files detected as WORM_AINJO.E. To do this, Trend Micro customers must download the latest pattern file and scan their system. Other Internet users can use HouseCall, Trend Micro's free online virus scanner.
Terminating the Malware Program
This procedure terminates the running malware process from memory. You will need the name(s) of the file(s) detected earlier.
Open Windows Task Manager.
On Windows 95/98/ME systems, press
CTRL+ALT+DELETE
On Windows NT/2000/XP systems, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file or files detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.
*NOTE: On systems running Windows 95/98/ME, Task Manager may not show certain processes. You may use a third party process viewer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing during startup.
Open Registry Editor. To do this, click Start>Run, type Regedit, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>RunServices
In the right panel, locate and delete the entry:
Kernelw="%Windows%\Kernelw32.exe"
Note: %Windows% is the default Windows folder, usually C:\Windows or C:\WinNT.
Close Registry Editor.
NOTE: If you were not able to terminate the malware process from memory as described in the previous procedure, restart your system.
Removing Autostart Entries from System Files
A malware modifies system files so that it automatically executes at every Windows startup. These startup entries must be removed before the system can be restarted safely.
Open the SYSTEM.INI file. To do this, click Start>Run, type SYSTEM.INI, then press Enter. This should open the file in your default text editor (usually Notepad).
Under the [boot] section, locate the line that begins with:
Shell=Explorer.exe
From the same line, delete the malware path and file name:
SCRNSAVE.EXE=%Windows%\Blank.scr
Locate and delete the following lines:
[WORM]
Name=I-WORM>PERKASA
Author=Iwing/Indovirus
Close the SYSTEM.INI file and click Yes when prompted to save.
Open the WIN.INI file using your default text editor. Click Start>Run, type WIN.INI, then press Enter.
Under the [windows] section, locate the line(s) that begin with:
load =
From the same line(s), delete the malware path and filename:
%Windows%\Kernelw32.exe
Close the WIN.INI file and click Yes when prompted to save.
Reply With Quote