If you have downloaded the vbswormremover that I have posted here before, I mentioned in the header and my post that I have edited it to include pooh.vbs. True enough that it can remove the file pooh.vbs. However, I was able to encounter the fully working worm just today, thus I just found out how this worm really works.
One visual symptom of this worm is that it loads the internet explorer during the windows startup with a webpage with black backround and the word "aikelyu". (Sorry to screen shot, it wasn't my pc and I lost my flash drive recently, fixed the pc in a rush).
This worm, is almost similar to imkulot worm, except for the webpage. It is loaded via autorun.inf that runs pooh.vbs using wscript.exe and puts the following files in the windows/system32 folder
- kernell.dll.vbs
- aikelyu.html
and adds entries on the startup registry that runs this two files. I initially intended to make an instruction on how to completely remove the pooh.vbs worm (or some call it antz virus) to makeup what the
vbswormremover is missing, however, I realized it's easier to edit that myself and just give the instruction on how to remove the registry entry of this worm.
- Download the vbswormremover
- restart in safemode
- run the vbswormremover - this will kill the wscript.exe from the task and delete the autorun.inf and pooh.vbs from the root directories of all available drives. I also added the lines that deletes the kernell.dll.vbs and aikelyu.html from the windows/system32 folder.
- Next is cleaning the registry manually.
Using Hijackthis (if you know how to use this safely, do it)
Caution: Follow this instruction very carefuly!- Run hijackthis
- click scan
- and check all entries with 'kernel.dll.vbs' and 'aikelyu.html'
- Click fix selected entries
Using regedit
Caution: Follow this instruction very carefuly!
- Run regedit (Program->Run->regedit)
- Select the Path: "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"
- Find Shell(String Value), modify its value to "Explorer.exe" (Do not delete)
- Remove this ->"C:\WINDOWS\system32\kernel.dll.vbs", you can see it is added to the Shell(String value)
Now restart your computer to normal mode and check if the worm is still there.