smile.exe - Dangerous
smile.exe
Jeff's Story:
My PC had gotten a bad rootkit that my ISP antivirus software (powered by McAfee) could not detect, nor could fix.
I sought a solution on the Internet and discovered your product and tried out the trial.
You quickly found the rootkit and SAVED my PC!
I haven't had any problems since, and I'm extremely grateful.
Manual removal instructions:
It spreads through the e-mail in attachment files. This worm have size about 75KB and written with Visual Basic.
It contains the following lines:
Smile Internet Explorer CD_Open
When the worm is activated it copyes itself to C:\WINDOWS\Start Menu\Programs\StartUp\Smile.exe and in C:\Poems.exe.
It deletes the following files in Windows folder:
Defrag.exe
Tuneup.exe
Regedit.exe
and C:\Program Files\Internet Explorer\Iexplore.exe
Then deletes .LNK files in C:\Windows\Desktop.
Deletes Norton Antivirus folders:
C:\Program Files\Symantec Shared
C:\Program Files\Norton AntiVirus\v32scan.dll
C:\Program Files\Norton AntiVirus\Navtask.dll
C:\Program Files\Norton AntiVirus\Navtasks.dll
c:\program files\common files\Symantec Shared\scriptblocking
And copyes itself in their place with their names.
Also this worm deletes the Media Player: C:\Program Files\Windows Media Player\wmplayer.exe
And creates empty folder "Ok" on drive A:.
Automatic removal:
Use RegRun Startup Optimizer to remove it from startup.