Troubleshooting brontok virus

9 months ago

This windows PC worm is most rapidly spread over the internet and is well known to reach you as an attachment of e-mail and forwards itself to email addresses in your contacts list or to your IM contacts.

It creates registry values that disables access to registry editor and also folder options in tools menu. It also creates .exe files in almost every folder on your PC usually named as folder itself.

As you know, almost all the virus are nothing but registry modifications that effect the stability of your system. When these registry keys and values are deleted, the system is recovered. As this Brontok virus has disabled the the access to registry editor itself, first lets enable it by deleting those unnecessary registry values using command prompt and then troubleshoot others.

#1. To access the command prompt go to Start-->Run... and type cmd or command and click OK

#2. At the command prompt type the following commands and press enter. Choose 'y' when prompted to confirm the deleting process.

reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\system /v DisableRegistryTools

reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools

These commands delete the registry value named "DisableRegistryTools" under the specified registry key and thus enables the registry editor.

#3. To enable the Folder Options, let's delete the registry value that is causing the problem.

Go to start-->Run... and type regedit and press OK.
This opens the registry editor window.

From the left pane of your registry editor, navigate through the registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
and delete the registry value found in the right pane named "NoFolderOption"

This process can also be done giving the below command at the command prompt.
reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOption

#4. Access registry editor and from the left pane navigate through the registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run to find registry entries with value name containing words such 'Brontok' or 'Tok-' and delete them.

#5. To remove unnecessary .exe files created on your PC, go to windows search and search for *.exe files in 'My Computer'
Also tick the boxes that says 'Search system folder','Search hidden files and folders' and 'search subfolders' under the More Advanced Options.

This will list out all the executable files on your system. Find those exe files that are displayed as folder icon usually with the name folder and delete them.

#6. Close all the Applications and restart your PC.

That's it!! You have successfully removed the Brontok worm virus.

As a precautionary note always be careful when accepting any email attachments from unknown sources. Its much better to defend your system by using a updated anti-virus software.

This was originally published here

Random Post