Core 2 Info

The malware disables the Registry Editor. To restore the said system tool, perform the following instructions:

1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:(begain below the stars and allign all code properly)
*******************************************************************************

Set WshShell = WScript.CreateObject("WScript.Shell")
With WScript.CreateObject("WScript.Shell")
On Error Resume Next
.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools"
.RegDelete "HKCU\Software\Policies\Microsoft\Windows\System\DisableCMD"
.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr"
.RegDelete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\DisableTaskMgr"
End With
Mybox = MsgBox(jobfunc & enab & vbCR & "Restore_Finished!", 4096, t)



3. Save this file as C:\RESTORE.VBS.
4. Click Start>Run, type C:\RESTORE.VBS, then press Enter.
5. Click Yes at the prompt of the message box.
**********************************************************************************
Removing Autostart Entry from the Registry

This solution deletes/modifies a registry entry added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.

2. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Run

3. In the right panel, locate and delete the entry:
Msn Messsenger = "%System%\regsvr.exe"

(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003.)

PLZ TELL US IF YOU ARE FACING ANY PROBLEM WE WILL TRY TO SOLVE IT BY HEART