WORM_COSMU.ELG

To terminate the malware/grayware process:

1. Open Windows Task Manager. To do this, press CTRL+SHIFT+ESC then click the Processes tab.
2. In the list of running programs*, locate the malware/grayware file/s detected earlier.
3. Select one of the detected files then press the End Process button.
4. Do the same for all detected malware/grayware files in the list of running processes.
5. To check if the malware/grayware process/es has/have been terminated, close Windows Task Manager then open it again.
6. Close Windows Task Manager.

To delete the registry value this malware created:

1. Open Registry Editor. To do this, click Start>Run, type regedit in the text box provided, then press Enter.
2. In the left panel of the Registry Editor window, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
   Microsoft = "%System Root%\Program File\Microsoft\MicrosoftSafety.exe"
4. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Run
5. In the right panel, locate and delete the entry:
   Microsoft = "%System Root%\Program File\Microsoft\MicrosoftSafety.exe"
6. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon>SpecialAccounts>UserList
7. In the right panel, locate and delete the entry:
   SYS_4321 = "0"
8. In the left panel of the Registry Editor window, double-click the following:
   HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Services>LanmanServer>Shares
9. In the right panel, locate and delete the entry:
   SYS_A$ = "CSCFlags=0"
10. Again In the right panel, locate and delete the entry:
    SYS_C$ = "CSCFlags=0"
11. Again In the right panel, locate and delete the entry:
    SYS_D$ = "CSCFlags=0"
12. Again In the right panel, locate and delete the entry:
    SYS_F$ = "CSCFlags=0"
13. Close Registry Editor.

To restore the registry value this malware/grayware modified:

1. Open Registry Editor. Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CLASSES_ROOT>Network>SharingHandler
3. In the right panel, locate the registry value:
   (Default) = ""
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   (Default) = ntshrui.dll
5. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
6. In the right panel, locate the registry value:
   HideFileExt = "1"
7. Right-click on the value name and choose Modify. Change the value data of this entry to:
   HideFileExt = 0
8. Again In the right panel, locate the registry value:
   ShowSuperHidden = "0"
9. Right-click on the value name and choose Modify. Change the value data of this entry to:
   ShowSuperHidden = 1
10. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
11. In the right panel, locate the registry value:
    shutdownwithoutlogon = "0"
12. Right-click on the value name and choose Modify. Change the value data of this entry to:
    shutdownwithoutlogon = 1
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SYSTEM>CurrentControlSet>Control>ComputerName>ComputerName
14. In the right panel, locate the registry value:
    ComputerName = "{Computer Name}-"
15. Right-click on the value name and choose Modify. Change the value data of this entry to:
    ComputerName = {Computer Name}
16. Close Registry Editor.

To delete malware/grayware/spyware folders:

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   
   • {malware path and file name}
   • %System Root%\Program File
   • %System Root%\Program File\Microsoft
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the folder then press SHIFT+DELETE to permanently delete the folder.
5. Repeat steps 2 to 4 for the remaining folders:
   • {malware path and file name}
   • %System Root%\Program File
   • %System Root%\Program File\Microsoft

To identify and delete AUTORUN.INF files created:

1. Right-click the Start button then choose Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
   AUTORUN.INF
3. In the Look in: drop-down list, select a drive, then press Enter.
4. Select the file, then open using Notepad.
5. Check if the following lines are present in the file:
   
   
   

   [autorun]
   open=%System Root%\COMM\COMM\svchost.exe
   shell\open\command=%System Root%\COMM\COMM\svchost.exe

6. If the lines are present, delete the file.
7. Repeat steps 3 to 6 for the remaining AUTORUN.INF files in other remaining removable drives.
8. Close Search Results.