Recovering from recurring infections on a network
The following additional steps may need to be taken to completely remove this threat from an infected network, and to stop infections from recurring from this and other similar types of network-spreading malware:
Ensure that an antivirus product is installed on ALL computers connected to the network that can access or host shares.
Ensure that all available network shares are scanned with an up-to-date antivirus product.
Remove any unnecessary network shares or mapped drives.
Note: Additionally it may be necessary to temporarily change the permission on network shares to read-only until the disinfection process is complete.
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
322756 How to back up and restore the registry in Windows
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.
To remove/modify the changes that Worm:Win32/Brotok.FFV has made to your computer, follow these steps:
1) Click Start and then click Run.
2) In the Open box, type regedit and then click OK.
3) Locate and then click on the following registry key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
4) On the right panel, right-click on the following registry entry:
Userinit
5) Select Modify and then click OK.
6) In the "Value data:" entry box, edit the data such that it only contains the following:
%windir%\system32\userinit.exe
7) Click OK, locate and then click on the following registry key:
HKLM\SYSTEM\CurrentControlSet\Control
8) On the right panel, right-click on the following registry entry:
AlternateShell
9) Select Modify and then click OK.
10) In the "Value data:" entry box, edit the data such that it only contains the following:
cmd.exe
11) Click OK, locate and then click on the following registry key:
HKLM\Software\Classes\txtfile\shell\open\command
12) On the right panel, right-click on the following registry entry:
(default)
13) Select Modify and then click OK.
14) In the "Value data:" entry box, edit the data such that it only contains the following:
%SystemRoot%\system32\NOTEPAD.EXE %1
15) Locate and then click on the following registry key:
HKLM\Software\Classes\comfile\shell\open\command
16) On the right panel, right-click on the following registry entry:
(default)
17) Select Modify and then click OK.
18) In the "Value data:" entry box, edit the data such that it only contains the following:
"%1" %*
19) Click OK and close Registry Editor.
