Manual removal steps: Disconnect your computer from the network and disable file sharings, if any.
Disable System Restore (for Windows XP/Windows Me only).
For Windows XP:
Click Start.
Right-click My Computer, and then click Properties.
Click the System Restore tab.
Select "Turn off System Restore" or "Turn off System Restore on all drives" check box. Start your machine in Safe mode.
How to start a computer in safe mode, pls refer to: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2001052409420406?OpenDocument&src=sec_doc_nam
Update your Anti-virus software with the latest signature files and scan your computer withthe Anti-virus to detect the worm and delete any files detected as the worm by clicking the DELETE button.
Delete the value from the registry.
You need to back up the registry before making any changes to it. In correct changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only.
How to make a backup of the Windows registry, pls refer at: http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617?OpenDocument&src=sec_doc_nam
Click Start > Run. Type regedit Click OK.
Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. You can used a tool to resolve this problem.
Download this tool. Once downloaded, �right-click� the UnHookExec.inf file and click install. Then continue with the removal steps. http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.HTML
Other alternative way to enable registry, please refer to: http://www.patheticcockroach.com/mpam4/index.php?p=28
Navigate to the subkey that was detected by the anti-virus and delete the value.
Exit the Registry Editor.
If you are still unable to open your registry, you may try the following steps.
Boot up the infected computer, but do not login to the server, leave it at the login prompt.
Start up another clean computer, worm-free computer which has an updated anti-virus software running and an active firewall running preventing all inbound connections.
From the clean computer, start REGEDIT.EXE and click on File -> File -> Connect Network Registry. Connect to the infected computer.
Modify the following values in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\NT\CurrentVersion\Winlogon to the following values:
"Userinit" = "C:\WINNT\system32\userinit.exe," "Shell" = "Explorer.exe"
(make sure that you enter the correct path to where Windows is installed. For example on NT4.0 it is WINNT)
After completing the above steps, reboot the infected computer.
Using the clean computer, map the C$ share and scan it using the up to date anti-virus to remove any infected files on the infected computer. Then, you should be able to boot to the computer and then follow Steps 6 - Steps 11.
Run a full system scan using an updated version of Anti-virus software and delete any files detected as worm.
Download and run a process management tool or process viewer to kill all worm processes running on the infected machine. The process management tool or the process viewer is available according to the machine's platform and can be downloaded free from the internet. For example users can download and use the following process viewer: http://www.sysinternals.com/Utilities/ProcessExplorer.HTML
Delete the scheduled tasks added by the worm. Click Start, and then click Control Panel. (In Windows XP, switch to Classic View.) In the Control Panel window, double click Scheduled Tasks. Right click the task icon and select Properties from pop-up menu. The properties of the task is displayed. Delete the task if the contents of the Run text box in the task pane matches the worm.
Enable the System Restore (for Windows XP/Windows Me only).
Re-scan your computer with an updated version of Anti-virus to confirm the computer is clean.
Re-connect your computer to the network once confirmed clean.
IMPROVED ANSWER WITH LINKS TO TOOLS (SOLVED BY A SENIOR IT SYSTEMS ADMIN) BY: Ian GardinerBrontok Virus Manual Removal Instructions
For Windows XP:
The worm may use various methods to run automatically each time Windows starts. Automatic startup methods that the worm employs may include:
With data:
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Delete the key.
with data: <path to Win32/Brontok worm>
in subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Delete the key.
with data: "explorer.exe " <path to Win32/Brontok worm>
in registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon. Delete the key.
with data: <Win32/Brontok file name>
in registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot
Note: the default setting for this key is "AlternateShell"="cmd.exe"
Win32/Brontok may attempt to lower security settings by making the following changes:
Adds value: DisableRegistryTools
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System. Change the Data to 0.
Adds value: Hidden
With data: 0
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced. Change the Data to 1.
Adds value: ShowSuperHidden
With data: 0
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced. Change the Data to 1.
Adds value: HideFileExt
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced. Change the Data to 0.
Adds value: NoFolderOptions
With data: 1
In subkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer. Change the Data to 0.
Answerno you can note remove brontok with avg but with ahlul Answer 2Brontok is a dangerous worm which can be removed with special malware removal utilities such as Brontok Removal Tool by Security Stronghold.
this is because of virus called "Brontok". Brontok virus will make some changes to the system restrictions in order to hide itself from easy detection and also from easy cleaning. there are simple way to get it back,, use free tool called Remove Restrictions Tool (RRT) which is able to re-enables all what the virus had previously disabled, and gives you back the control over your own computer.download Remove Restrictions Tool (RRT) at http://download.sergiwa.com/security/RRT.zip
Check this out http://www.sophos.com/security/analyses/w32traxgb.html
McAfee has the best virus removal software. It will also be good to learn how to remove virus files manually as some viruses will prevent you from using anti virus software.
There are some free anti virus software available but it is not as good as the paid ones. If the virus is preventing you from being able to use your virus software you will have to go into safe mode and remove the virus manually.
You can manually remove the virus by following this step: http://www.zooltechnology.com/content/index.php?option=com_content&task=view&id=300&Itemid=76
There's no way to really tell who is the "creator"of this virus but if you are infected, you can surely get rid of this malware by running a scan on your system and automatically remove it. You may also remove it manually if you wish.
Hi, Anti-Malware Lab is tricky and stubborn virus which can not be removed by antivirus application. We need to manually remove files and registry entries of the virus that are added onto the compromised system when get infected. However,Manual removal is recommended only for advanced users as it refers to key parts of the system, any error may result system damage. This is what I learnt from some excellent tech guy when I got infected with the same virus. I got online help to remove the virus
Below-mentioned are the techniques of removing Google redirect virus: 1) By manually changing home page(s) 2) By repairing Windows host file and reset proxy settings For more details visit: Optimo AV blog and find the topic how to remove Google redirect virus. optimoav.com/blog/how-to-remove-google-redirect-virus
Norton doesn't remove this virus. In my experience it worked best to run adware se (download free). After that manually remove the infected files from your PC by using the 'search' option and paste the location (copied from the Norton log). Remove by pressing <Shift> <Del>. This should do the trick.
You can remove this virus automatically or manually. For automatic removal check out http://www.spyware-review.net - a few spyware removers featured there. If you want a manual removal, it's more difficult and involves messing with your registry in the LOCAL_HKEY_USER folder and disabling programs that are associated with virus remover 2008, which is fake scamware.
This Windows Accurate Protector is a dangerous threat to your computer and you need to remove it amnually, this site may help you a lot. .pcfixessupport.com/cannot-remove-windows-accurate-protector-virus-how-to-uninstall-windows-accurate-protector-manually/ And if you have any difficulties, just contact online computer experts to help you.