3 thoughts on “worms and things

  1. If it’s the Benjamin worm then you can do the following:

    Manual Removal
    If infected with the Benjamin worm, the following registry keys will have been modified to include the value shown:

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "System-Service"="C:\WINDOWS\SYSTEM\EXPLORER.SCR"
    [HKEY_LOCAL_MACHINE\Software\Microsoft]
    "syscod"="0065D7DB20008306B6A1"

    Locate and delete the values shown.
    Locate and delete the file EXPLORER.SCR.
    Locate and delete the Sys32 subfolder located in the Windows Temp folder.

Leave a Reply