End Infected Processes

• 1). Press Ctrl + Alt + Delete.
  
  
• 2). Click on the "Task Manager."
  
  
• 3). Click on the "Processes" tab.
  
  
• 4). End the following processes. To end a process, simply right-click on it and select "End Process."
  
  "nvctrl.exe"
  "msmsgs.exe"
  "regperf.exe"
  "ld100.tmp"
  
  

Delete Infected Registry Values

• 1). Click on the "Start" menu.
  
  
• 2). Click on "Run."
  
  
• 3). Type "regedit" (without the quotation marks) into the open box and click "OK." The Registry Editor window will open.
  
  
• 4). Locate the registry values in the left pane of the Registry Editor window and delete them. To delete a registry value, simply right-click on it and select "Delete."
  
  "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRunRegSvr32=%System%msmsgs.exe"
  "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsNTCurrentVersionWinlogonShell=explorer.exe"
  "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler{af73a174-ea1b-4f0b-b0b1-fe1486a6719c} = communa"
  
  

Delete Infected Files

• 1). Click on the "Start" menu.
  
  
• 2). Click on "Search Files and Folders."
  
  
• 3). Search for and delete the following files. To delete a file, simply right-click on it and select "Delete."
  
  "hp[X].tmp"
  "msvol.tlb"
  "ncompat.tlb"
  "RSA"
  "Protect"
  
  

Delete Infected DLL Files

• 1). Click on the "Start" menu.
  
  
• 2). Click on "Run."
  
  
• 3). Type "cmd" (without the quotation marks) into the open box, and click "OK." The Command Prompt window will open.
  
  
• 4). Type "regsvr32 /u qdsba.dll" (without the quotation marks) into the Command Prompt window and press Enter.