Virus removal

[Guest]

July 12, 2003
I helped a friend remove a virus from a computer running
WIN Xp, home edition. The virus was I-worm/bugbear. The
antivirus software was Grisoft.com AVG 6.0 a free one.
It successfully removed the virus.....HOWEVER it had
infected "regedit.exe" and a warning apeared that if I
removed it, the computer may not boot up or run again.
I feel that I can safely remove it from the infected file.
Anyone have any ideas or help?
Thank you.
ralphk

 

[EGMcCann]

You can remmove regedit, and should be able to expand a fresh copy from the
install CD (if it's not automatically done.) It's only a file for editing
the registry - you're probably getting the message because it's in the
system directory.

 

[Kelly]

Do NOT remove regedit.exe. Remove the infected files from regedit. If you
can't get into the registry, rename regedit.exe to regedit.com and then
manually remove the run and runonce keys.

Better yet, run another anti-virus program and/or try these procedures.

http://www.srnmicro.com/virusinfo/bugbear.htm
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
/xp_tweaks.htm

Top 10 Frequently Asked Questions and Answers
http://www.kellys-korner-xp.com/top10faqs.htm

 

[T.C.]

I've used the Symantec/Norton Bugbear removal tool, without any problems on
many clients' systems. Try it:

http://www.symantec.com/avcenter/venc/data/[email protected]
l