wkfxi.js - Dangerous
%windir%\wkfxi.js
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
It is a Java Script file that copies itself throughout the C drive of the infected computer. It overwrites Autoexec.bat, as well as .vbs and .cmd files. The worm contains a mass-mailing routine and can also spread via mIRC, Pirch98, and vIRC.
Overwrites Autoexec.bat so that %Windir%\wigun.js is executed.
Copies itself to various folders.
Creates lpmvh.vbs, which is a mass-mailing routine.
Adds the value:
"stmha" = "%Windir%\wkfxi.js"
to Windows startup registry keys.
Sends itself by e-mail.
Use RegRun Startup Optimizer to remove it from startup.
Delete the worm's files from hard disk.