Hi all, handy site - just hope it can help me and i might be able to help others at some point.


Im having trouble following these steps below form this post on this forum:
http://www.bleepingcomputer.com/forums/ind...showtopic=10501

QUOTE
To remove this infection you must remove the following registry keys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\winlow
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\winlow
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdmt16
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vdmt16
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\drct16

Ok I can do this bit no problem but the paragraph below i dont understand how to do. How do i remove permissions then add permission and then take ownership? And what is sc delete? is that a registry command?

These keeps need to be removed first but you must remove all permissions to the keys, then add everyone to it with full permission and then take ownership to delete them:

QUOTE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDMT16
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_WINLOW

This can be accomplished easily in Windows XP by running:

sc delete winlow
sc delete VDMT16


and then delete the Winlogon Notify key.

Id be grateful for any help, apologies if i'm being a newb.

Are you using XP? If so then just click on start, then run, and type:

sc delete winlow

and press the ok button.

Then click on start, run, and type:

sc delete VDMT16

and press the ok button.