Removing Pooh.vbs (update)

If you have downloaded the vbswormremover that I have posted here before, I mentioned in the header and my post that I have edited it to include pooh.vbs. True enough that it can remove the file pooh.vbs. However, I was able to encounter the fully working worm just today, thus I just found out how this worm really works.

One visual symptom of this worm is that it loads the internet explorer during the windows startup with a webpage with black backround and the word "aikelyu". (Sorry to screen shot, it wasn't my pc and I lost my flash drive recently, fixed the pc in a rush).

This worm, is almost similar to imkulot worm, except for the webpage. It is loaded via autorun.inf that runs pooh.vbs using wscript.exe and puts the following files in the windows/system32 folder

• kernell.dll.vbs
• aikelyu.html

and adds entries on the startup registry that runs this two files. I initially intended to make an instruction on how to completely remove the pooh.vbs worm (or some call it antz virus) to makeup what the vbswormremover is missing, however, I realized it's easier to edit that myself and just give the instruction on how to remove the registry entry of this worm.

• Download the vbswormremover
• restart in safemode
• run the vbswormremover - this will kill the wscript.exe from the task and delete the autorun.inf and pooh.vbs from the root directories of all available drives. I also added the lines that deletes the kernell.dll.vbs and aikelyu.html from the windows/system32 folder.
  
• Next is cleaning the registry manually.

Using Hijackthis (if you know how to use this safely, do it)
Caution: Follow this instruction very carefuly!

• Run hijackthis
  
• click scan
• and check all entries with 'kernel.dll.vbs' and 'aikelyu.html'
• Click fix selected entries

Using regedit
Caution: Follow this instruction very carefuly!

• Run regedit (Program->Run->regedit)
• Select the Path: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
  
• Find Shell(String Value), modify its value to "Explorer.exe" (Do not delete)
• Remove this ->"C:\WINDOWS\system32\kernel.dll.vbs", you can see it is added to the Shell(String value)

Now restart your computer to normal mode and check if the worm is still there.