Aliases
-
Worm.Win32.VB.du
-
W32.Rungbu
-
PE_RUNGBU.A
Characteristics
-
Installs itself in the registry
-
Leaves non infected files on computer
Affected Operating Systems
Recovery Instructions:
Please follow the instructions for disinfecting pe viruses.
Delete all files detected as W32/Rungbu-A.
Restore all registry entries detailed in the Advanced Description to their defaults, and set the following registry entries in order to show extensions and hidden files:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt
0
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFile
Ext
UncheckedValue
0
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
ShowSuperHidden
1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHid
den
UncheckedValue
1
Change the attributes of the original DOC files to stop them being hidden.