1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Restart your system in safe mode.
3. Run a full system scan.
4. Delete these values added to the registry.

NB: Use this Symantec Tool to reset shell\open\command registry keys if regedit (Registry editor) is not accessible .

Delete the following registry entry:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"winstart" = %System%\winstart.exe

Delete the following registry subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winstart