W32/Randex-C

Please follow the instructions for removing worms.

Please follow the instructions for removing worms.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ Microsoft Netview = gesfm32.exe
and
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\ Microsoft Netview = gesfm32.exe

and delete them if they exist.

Close the registry editor.

W32/Randex-C is a network worm with backdoor capabilities which allows a remote intruder to access and control the computer via IRC channels.

Each time W32/Randex-C is run it tries to connect to a remote IRC server and join a specific channel. W32/Randex-C then runs in the background as a server process, listening for commands to execute.

When first runW32/Randex-C copies itself to Windows System folder as gesfm32.exe and creates the registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ Microsoft Netview = gesfm32.exe
and
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\ Microsoft Netview = gesfm32.exe

so that gesfm32.exe is run automatically each time Windows is started.

W32/Randex-C can also spread to other computers on the local network by copying itself to shared system32 folders as msmonk32.exe.