Affected Operating Systems
Recovery Instructions:
Please follow the instructions for disinfecting pe viruses.
Please read the instructions for removing PE executable viruses.
You will also need to edit the following registry entry.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
The virus will have added the text "C:\<Windows>\APPBOOST.EXE to each of the HKEY_CLASSES_ROOT registry entries listed above. They should be edited to remove this text:
HKCR\exefile\shell\open\command = "%1" %*"
HKCR\scrfile\shell\open\command = "%1" /S"
HKCR\comfile\shell\open\command = "%1" %*"
HKCR\batfile\shell\open\command = "%1" %*"
HKCR\piffile\shell\open\command = "%1" %*"
HKCR\cmdfile\shell\open\command = "%1" %*"
Note: delete only the path and name of the virus. Do not delete anything else.
Close the registry editor.