Virus-like program that spreads automatically to other computers by sending itself out by email or by any other means. A program that propagates itself by attacking other machines and copying itself to the affected machine.
Worms have self-replicating code that travels from machine to machine by various means. A worms first objective is merely propagation. Worms can be destructive depending on what payload they have been given. Worms may replace files, but do not insert themselves into files.
Comment:
This is a mass mailing worm. It makes system unstable.
Manual
removal:
Here is a manual removal instructions for the worm Rontokbro
It is recommended that you take a print-out of these instructions (and keep them handy) before starting the cleaning up of the machine.
1.Restart the machine, and while it is booting up, press the "F8" button and from the options available, select the option "Safe mode with command prompt"
2.Once the computer has booted up ,in the command prompt, go to the directory where X-Cleaner is installed (it usually is c:\Program Files\X-Cleaner\)Once the computer has booted up, go to the directory where X-Cleaner is installed (it usually is c:\Program Files\X-Cleaner\)
3.Now type XCleaner_full.exe and press Enter. (if Xcleaner exe is named as Xcleaner.exe type in Xcleaner.exe)
4.In the Xcleaner GUI, go to "Malware scanner" tab and press "start scans for malware" to start the full scan of the machine.
5.After the scan is run, X-Cleaner shall ask for reboot, let the machine get booted-up in normal mode now.
Once it re-boots,
6.open Command prompt , and type in the following commands:
7.type in "Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System/v DisableRegistryTools /d 0" and press enter.
8.If asked for overwriting type "Y" and press enter
9.type in "Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoFolderOptions /d 0"
10.If asked for overwriting type "Y" and press enter
11.type in "Reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced/v ShowSuperHidden /d 1"
12.If asked for overwriting type "Y" and press enter
13.Type regedit and press enter. It shall open up the Registry Editor.
14.Double click the "HKEY_LOCAL_MACHINE" directory. This will open the tree below it.
15.Go to "SOFTWARE" directory and double click.
16.Go along the opened tree and double click "Microsoft" to open the new tree.
17.Double click on "Windows NT".
18.Open "CurrentVersion" under "Windows NT" by double clicking it.
19.Go to "Winlogon" key under "CurrentVersion".
20.on the right side pane right click on value "Shell" and click "Modify".
21.Change the data from 'Explorer.exe "C:\WINDOWS\eksplorasi.exe" ' to "Explorer.exe" If asked for confirmation click "yes".
22. Exit the regedit.
7 [