How to remove Worm - W32.Mikbaland ?

February 20, 2008

The following instructions pertain to all current and recent Symantec antivirus products, including the Symantec AntiVirus and Norton AntiVirus product lines.

1. Follow standard procedure for virus removal

2. Delete these values and subkeys added to registry.



* HKEY_CURRENT_USER\Software\mmtest
* HKEY_CURRENT_USER\Software\mmtest\IEXPLORER


This Worm may create following files on compromised system , if found try to remove it in safe mode .

* 360rpt.EXE
* 360safe.EXE
* 360tray.EXE
* ANTIARP.exe
* Ast.EXE
* AutoRunKiller.exe
* AvMonitor.EXE
* AVP.EXE
* CCenter.EXE
* Frameworkservice.EXE
* IceSword.EXE
* Iparmor.EXE
* KASARP.exe
* KRegEx.EXE
* KVMonxp.kxp
* KVSrvXP.EXE
* KVWSC.EXE
* Mmsk.EXE
* Navapsvc.EXE
* Nod32kui.EXE
* QQDOCTOR.EXE
* Regedit.EXE
* VPC32.exe
* VPTRAY.exe
* WOPTILITIES.EXE
* Wuauclt.EXE