Troj/Krepper-G

Please follow the instructions for removing Trojans.

You will also need to edit the following registry entries, if they are present. Please read the warning about editing the registry.

At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.

Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.

Locate the HKEY_LOCAL_MACHINE entry:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
xp_system = c:\windows\inetndata\services.exe

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects\(5321E378-FFAD-4999-8C62-03CA8155F0B3)

and delete them if they exist.

Each user has a registry area named HKEY_USERS\[code number indicating user]\. For each user locate the entries:

HKU\[code number]\Software\Microsoft\Windows\
CurrentVersion\Run\xp_system = c:\windows\inetndata\services.exe

HKU\[code number]\Software\Microsoft\Windows NT\
CurrentVersion\Windows\run = "C:\\WINDOWS\\inetdata\\services.exe"

and delete them if they exist.

Close the registry editor.

Replace the Hosts file from a backup or edit it in Notepad to remove the changes that the worm has made.

To disable the Internet Explorer change:

• select Start|Settings|Control Panel and double-click 'Internet Options'
• click the Advanced tab
• in the Browsing section, deselect 'Enable third-party browser extensions (requires restart)'
• click 'OK'.

See Microsoft Knowledge Base Article 298931 for further information on this registry entry.

Troj/Krepper-G is Trojan which changes browser settings, downloads and installs/runs new software and modifies the HOSTS file to redirect internet searches.

The Trojan copies itself to the Windows\inetdata folder as services.exe and creates the following registry entries so as to auto-start on user logon or system start.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
xp_system = c:\windows\inetndata\services.exe

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
xp_system = c:\windows\inetndata\services.exe

HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\
run = "C:\\WINDOWS\\inetdata\\services.exe"

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Browser Helper Objects\(5321E378-FFAD-4999-8C62-03CA8155F0B3)

HKCU\Software\Microsoft\Internet Explorer\Main\
Enable Browser Extensions = "yes"