About Dumaru
Also known as: W32.Dumaru@mm, W32/Dumaru@MM,
WORM_DUMARU.A
This mass mailing worm has been proactively detected with
internal heuristics as "virus or variant of New Malware-b"
with the 4.2.40 engine and 4239 DAT combination (or greater)
since 12/23/2002.
The worm trawls the harddisk for files with extensions .htm
.wab .html .dbx .tbb .abd for email addresses to send
itself to. These email addresses are written to file winload.log.
Variants:
Removal Instructions
Automatic Removal:
Dumaru can be detected and removed
AUTOMATICALLY
by McAfee
VirusScan, also SpyEraser.
Manual Removal:
To remove this virus "by hand", follow these
steps:
- - Win9x/ME - Reboot the system into Safe Mode (hit the
F8 key as soon as the Starting Windows text is displayed,
choose Safe Mode.
- WinNT/2K/XP - Terminate the processes:
- LOAD32.EXE
- VXDMGR32.EXE
- DLLREG.EXE
- Delete the following files:
- %WinDir%\DLLREG.EXE
- %SysDir%\LOAD32.EXE
- %SysDir%\VXDMGR32.EXE
- Edit the registry
- Delete the "Load32" value from
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Run
- Edit the "Run" value in the following key
from "C:\WINDOWS\DLLREG.EXE" to
"":
- HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- Edit the "Shell" value in the following
key from "explorer.exe %sysdir%\vxdmgr32.exe"
to "explorer.exe":
- HKEY_LOCAL_MACHINE\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon
Additional
Windows ME/XP removal considerations
Sponsored Links:
Removal Instructions for Other Worms
| 
