حمل هذا البرنامج
ftp://ftp.microworldsystems.com/download/tools/mwav.exe

أو من
ftp://update.mailscan.info/download/tools/mwav.exe

http://www.mwti.net/download/tools/mwav.exe





بعد الفحص إذهب إلى

Click Start > Run.
Type regedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Windows\Curr entVersion\Run


In the right pane, delete the value:

إعمل شطب

"Bron-Spizaetus" = "%Windir%\INF\norBtok.exe "


Navigate to the subkey:

HKEY_CURRENT_USER\Softwar e\Microsoft\Windows\Curre ntVersion\Run


In the right pane, delete the value:

إعمل شطب

"Tok-Cirrhatus" = "%UserProfile%\Local Settings\Application Data\smss.exe"

Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWA RE\Microsoft\Windows NT\CurrentVersion\Winlogo n

In the right pane, reset the value to its default value:
إنسخ هذه القيمة
"Shell" = "Explorer.exe"

Navigate to the subkey:

HKEY_CURRENT_USER\Softwar e\Microsoft\Windows\Curre ntVersion\Policies\Explor er

In the right pane, reset the following value to its default value if required:
إنسخ هذه القيمة
"NoFolderOptions" = "0" or "NoFolderOptions" = "1"

Navigate to the subkey:

HKEY_CURRENT_USER\Softwar e\Microsoft\Windows\Curre ntVersion\explorer\advanc ed

In the right pane, reset the following values to their default value if required:
إنسخ هذه القيمة
"Hidden" = "0" or "Hidden" = "1"
"ShowSuperHidden" = "0" or "ShowSuperHidden" = "1"
"HideFileExt" = "0" or "HideFileExt" = "1"

Exit the Registry Editor.


6. To delete the scheduled tasks added by the worm
Click Start, and then click Control Panel. (In Windows XP, switch to Classic View.)
In the Control Panel window, double click Scheduled Tasks.
Right click the task icon and select Properties from pop-up menu.
The properties of the task is displayed.
Delete the task if the contents of the Run box in the task pane, matches the following:
إعمل شطب
%Windir\Tasks\At1.job