Member Panel

Fix this one only if you havent set any I.E. restrictions youreself with any kind of anti spyware app:
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

These can be fixed:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://www.joyiex.com
O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - (no file)

4. To delete the value from the registry
Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. For instructions refer to the document: How to make a backup of the Windows registry.

Click Start > Run.
Type regedit
Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Security Response has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run


In the right pane, delete the value:

"ctfnom.exe" = "%Windir%\SVOHOST.exe"


Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon


In the right pane, delete the value:

"Shell" = "Explorer.exe commamd.exe"


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\
Policies\system


In the right pane, delete the value:

"DisableTaskMgr" = "1"


Navigate to the subkey:

HKEY_CURRENT_USER\Software\Policies\Internet Explorer\ControlPanel


In the right pane, delete the value:

"HomePage" = "1"


Navigate to the subkey:

HKEY_CLASSES_ROOT\txtfile\shell\open


In the right pane, modify the value:

"command" = "%System%\lsasa.exe "%1""

to:

"command" = "%System%\NOTEPAD.EXE "%1""


Exit the Registry Editor.