mskernel32.vbs - Dangerous
mskernel32.vbs
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
This is the Internet worm that caused the global epidemic at the beginning of May 2000.
The worm spreads via e-mail by sending infected messages from affected computers.
The worm uses MS Outlook and sends itself to all addresses that are stored in the MS Outlook Address Book.
When run, the worm sends its copies by e-mail, installs itself into the system, performs destructive actions, downloads and installs a Trojan program.
The worm also has the ability to spread through the mIRC channels.
These files are registered in the Windows auto-run section in the system registry:
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32 = MSKERNEL32.VBS
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\Win32DLL = Win32DLL.VBS
You can manually delete these key to disable this worm.