Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
June 13, 2000
The following fix was submitted by Mike Rhodes, [email protected]
Mike uses regdelete. You may also use reg, reg, or regedit.
For WINNT and (hopefully) WIN98/95 by Mike Rhodes email: [email protected] fix is not warranted or guaranteed in any way..Use the below changes for a Windows registery entries atyour own risk! This was tested once under WINNT/REGEDIT only! This just might repair win95/98 user registers too!Some users may need to run REGEDIT32 instead of REGEDIT.(WIN98 users replace the name WINNT with WIN98/WIN95)What this does NOT fix... This does not repair all those nice PICTURE/SOUND files thathave been corrupted with the VIRUS! In all likelyhood, you will need to DELETEALL files that have the suffix of "vbs". So, file name "PICTURE.vbs" or "Multi.Media.sound.mp3.vbs" is probably corrupted and needs to be deleted... Run anAnti-Virus routine to clean these up. I used Norton AntiVirus and picked up the latest LIVEUPDATE from the internet. But, even Norton doesn't repair all the damage. (the possibles are: .vbs, .vbe, .js, .jse, .css, .wsh, .sct, .hta, .jpg, .jpeg, .wav, .txt, .gif, .doc, .htm, .html, .xls, .ini, .bat, .com, .mp3, and .mp2. )To fix the WinNT Registery..FIRST!CLOSE/stop your web browser (if opened/started)These entries will need to be deleted/removed regdelete "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunMSKernel32",dirsystem&"MSKernel32.vbs"regdelete "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunWIN-BUGSFIX",downread&"WIN-BUGSFIX.exe"regdelete "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesWin32DLL",dirwin&"Win32DLL.vbs"- here's how...WinNT - Start/Run/REGEDIT HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunName: MSKernel32 Data: c:WINNTsystem32MSKernel32.vbsaction:RIGHT CLICK on NAME "MSKernel32"action:Select "DELETE" (and confirm it)STEP 2.. FOLDER HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunServicesIf this NAME is the only name in "RunServices" then:Name: Win32DLLData: c:WINNTWin32DLDL.vbsthen, DELETE the FOLDER action: RIGHT CLICK on "RunServices" FOLDER and Select "DELETE" (and confirm it)If it is NOT the only NAME in RunServices then: delete only: NAME: Win32DLLaction: RIGHT CLICK on NAME "Win32DLL"action: Select "DELETE" (and confirm it) Step 3.. DELETE (delete if found - may not be found) HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunName: WIN-BUGSFIX Data: c:WINNTsystem32WIN-BUGSFIX.exeaction:RIGHT CLICK on NAME "MSKernel32"action:Select "DELETE" (and confirm it)This entry needs to be modifiedStep 1 HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Pageaction: RIGHT CLICK on NAME "Start Page"action: Modifychange the Value Data to: http://www.microsoft.com(or some other friendly web site url)Click "OK"Now CLOSE REGEDIT+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++This is the data that is BAD. These entries need to be changed to a different "HOME PAGE". DO NOT USE THESE ENTRIES FOR YOUR HOME PAGE. (this is what causes more problems every time you open your web browser)regdelete "HKCUSoftwareMicrosoftInternet ExplorerMainStart Page","http://www.skyinet.net/~young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnjw6587345gvsdf7679njbvYT/WIN-BUGSFIX.exe"regdelete "HKCUSoftwareMicrosoftInternet ExplorerMainStart Page","http://www.skyinet.net/~angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX.exe"regdelete "HKCUSoftwareMicrosoftInternet ExplorerMainStart Page","http://www.skyinet.net/~koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnmPOhfgER67b3Vbvg/WIN-BUGSFIX.exe"regdelete "HKCUSoftwareMicrosoftInternet ExplorerMainStart Page","http://www.skyinet.net/~chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkhYUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX.exe"++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++as a precaution!.. we cleared out the temporary internet file & history, cleared documents from the taskbar menu, emptied all the trashbuckets, then re-booted, shutdown/restart style. ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
You might also want to check out Woody "Cure for Love" fix at http://www.woodyswatch.com/special/.
You May Also Like