IMG-WMF vulnerability of the attacker: Exploit.Win32.IMG-WMF.a

Risk level: High

virus Description

The sample is a Exploits program, the size of “25,088 bytes”,  icon “
“, Virus extension” exe “, mainly through the” file bundle “,” Web trojan”, ” vulnerabilities ” and other modes to spread. The main purpose of the virus is to download malicious code to the user’s computer to run.After poisoning the user’s computer, will appear to run Slow computer and network security software, shut down for no reason, various types of software, Windows and other phenomena without undue error

Infected OS

Windows 2000/Windows XP / Windows 2003/Windows Vista / Windows 7

Transmission

Web Trojans, file bundle, download manager

Manual Solution:

1. Manually delete the following files:

% SystemRoot% \ system32 \ dirvers \ Beep.sys
% Temp% \ 6611E.tmp
% Temp% \ svchost.exe
% Temp% \ urlm0n.dll

2. Manually delete the following Registry:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RStray.exe

Variable declaration:

% SystemDriver% partition where the operating system, typically “C: \”
% SystemRoot% WINDODWS directory, usually “C: \ Windows”
% Documents and Settings% user documentation directory, usually “C: \ Documents and Settings”
% Temp% temp folder, usually “C: \ Documents and Settings \ current user name \ Local Settings \ Temp”
% ProgramFiles% system program default installation directory, typically: “C: \ ProgramFiles”

The virus creates files:

% SystemRoot% \ system32 \ dirvers \ Beep.sys
% Temp% \ 6611E.tmp
% Temp% \ svchost.exe
% Temp% \ urlm0n.dll

Virus creates registry keys:

HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Image File Execution Options \ RStray.exe

Recommended antivirus software

Manual removal of Virus is a cumbersome task and can not always ensure complete removal of the malware, due to the fact that some files might be hidden or may get reanimated automatically afterwards.

So, you need a most effective anti-virus software.I recommend you to use Spyware Cease.

How to remove virus Automatically?

1. Restart your computer and keep pressing F8 Key before Windows launches. Use the arrow keys to select the "Safe Mode with Networking" option, and then hit ENTER Key to continue.

2. Download Spyware Cease, install it and update its database to the latest. After that, restart your computer so as to make Spyware Cease fully functional. Repeat Step 1 into Safe Mode and run an Online Scan of your computer so that Spyware Cease can detect all potential malware in your system.

3. After the Online Scan finishes, click "Details" for the malware detected to make sure that your important data are not infected and removed. Ignore or select the scan result and click "Remove" to remove the threats. Reboot your computer and let Spyware Cease delete all detected virus.

Download and Installation Instructions

To download and install Spyware Cease™ please follow these instructions below.

• The file will automatically popup over your PC screen.
• When the File Download dialog box appears click the "Save" button.
• When the Save As dialog box appears choose a folder location and save the file to a location on your computer, for example, to your Desktop
• Wait for the file to download; then close all applications including the browser.
• Double-click on the saved file icon to start the installation process.