Re: Re: Registry

[DSTM]

Thanks for the detailed explanation,Dak.We all learn from your expertize.Why I started this thread,is that I was reading about a Worm, W32 TIDNS- msqpd xvx,and for a Dummy run, googled Remove.The removal instructions were not clear,to me,so I asked how to Backup the Registry,how to navigate the Registry,stop MS services,etc etc.I followed these instructions but got lost on entering the Registry.Read somewhere else,you type regedit,in the run Box.I got lost where the Bold text starts.Still don't know how to find an Image Path.You are right,it's not for the faint hearted.Will download the Program,TY.Sorry,if I am a pain in the Butt.Just want to learn. 🙂How to Remove W32.Tidns:by precisesecurity December 11th, 2008 at 1:28 am1. Temporarily Disable System Restore (Windows Me/XP). [how to]2. Update the virus definitions.3. Reboot computer in SafeMode [how to]4. Run a full system scan and clean/delete all infected file(s)5. Find and stop the service:- Click Start > Run.- Type services.msc, and then click OK.- Locate and select the service:Startup Type: AutomaticImage Path = %System%driversmsqpdxserv.sys- Click Action > Properties.- Click Stop.- Change Startup Type to Manual.- Click OK and close the Services window.6. Delete/Modify any values added to the registry. [how to edit registry]Navigate to and delete the following registry entries:HKEY_CLASSES_ROOTmsqpdxvx”msqpdxrun” = “47000000?HKEY_CLASSES_ROOThomeviewCLSID”default” = “{6BF52A52-394A-11D3-B153-00C04F79FAA6}”HKEY_CLASSES_ROOTmsqpdxvx”msqpdxpff” = “6D200000?HKEY_CLASSES_ROOTmsqpdxvx”msqpdxaff” = “DD0C0000?HKEY_CLASSES_ROOTmsqpdxvx”msqpdxinfo” = “.}gx~yc.~e.cfbnnbvkonrlomNYUc”HKEY_CLASSES_ROOTmsqpdxvx”msqpdxid” = “rfx.s|.~za.ggacgojjh”HKEY_CLASSES_ROOTmsqpdxvx”msqpdxsrv” = “19F70268?HKEY_CLASSES_ROOTmsqpdxvx”msqpdxpos” = “5}~p}}t{}p4biedba`az”Navigate to and delete the following registry subkey:HKEY_LOCAL_MACHINESystemCurrentControlSetServicesmsqpdxserv.sys7. Exit registry editor and restart the computer.8. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.