WORM_OTORUN.XXQK

To enable Registry Editor, Task Manager, and Folder options:

1. Open Notepad. To do this:
   
   • For Windows 2000, XP, and Server 2003 users:
     Click Start>Run, type Notepad in the text box provided, then press Enter.
   • For Windows Vista, 7, and Server 2008 users:
     Click start. Type Notepad , then press Enter.
   • For Windows 8, 8.1, and 2012 users:
     Right-click on the lower left corner of the screen. Click Run. Type Notepad in the input field, then press Enter.
2. Copy and paste the following script:
   On Error Resume Next Set shl = WScript.CreateObject("WScript.Shell") shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr" shl.RegDelete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions" shl.RegDelete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions"
3. Save this file as C:\RESTORE.VBS.
4. Run C:\RESTORE.VBS by double-clicking on the file.
5. Click Yes at the prompt of the message box to execute the .VBS file.

To delete the registry key this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies
3. Still in the left panel, locate and delete the key:
   Explorer
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>SOFTWARE>Microsoft>Windows>CurrentVersion>Policies
5. Still in the left panel, locate and delete the key:
   System
6. Again Still in the left panel, locate and delete the key:
   NetWork
7. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE
8. Still in the left panel, locate and delete the key:
   WinCtrlProc
9. Close Registry Editor.

To delete the registry value this malware/grayware created:

1. Open Registry Editor.
   » For Windows 2000, Windows XP, and Windows Server 2003 users, click Start>Run, type regedit in the text box provided, and then press Enter.
   » For Windows Vista, Windows 7, and Windows Server 2008 users, click the Start button, type regedit in the Search input field then press Enter.
   » For Windows 8, Windows 8.1, and Windows Server 2012 users, right-click on the lower-left corner of the screen, click Run, type regedit in the text box provided, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
3. In the right panel, locate and delete the entry:
   ShowSuperHidden = "0"
4. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Policies>NetWork
5. In the right panel, locate and delete the entry:
   NoNetSetup = "1"
6. In the left panel, double-click the following:
   HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>Explorer
7. In the right panel, locate and delete the entry:
   NoControlPanel = "1"
8. Again In the right panel, locate and delete the entry:
   NoNetHood = "1"
9. Again In the right panel, locate and delete the entry:
   NoStartMenuNetworkPlaces = "1"
10. Again In the right panel, locate and delete the entry:
    NoDrives = "4"
11. Again In the right panel, locate and delete the entry:
    NoRun = "1"
12. Again In the right panel, locate and delete the entry:
    NoSetTaskbar = "1"
13. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows>CurrentVersion>policies>system
14. In the right panel, locate and delete the entry:
    NoDispCPL = "1"
15. Again In the right panel, locate and delete the entry:
    NoDispScrSavPage = "1"
16. In the left panel, double-click the following:
    HKEY_LOCAL_MACHINE>SOFTWARE>WinCtrlProc
17. In the right panel, locate and delete the entry:
    WinSysMkName = "{malware file name}"
18. Again In the right panel, locate and delete the entry:
    WinSysMkState = "1"
19. Close Registry Editor.

To restore registry values this malware/grayware modified:

1. Open Registry Editor. To do this:
   
   • On Windows 2000, XP, and Server 2003:
     Click Start>Run, type REGEDIT in the text box provided, and then press Enter.
   • On Windows Vista, 7, and Server 2008:
     Click the Start button, type REGEDIT in the Search input field then press Enter.
   • On Windows 8, 8.1, and Server 2012:
     Right-click on the lower left corner of the screen and click Run, type REGEDIT in the Run input field, and then press Enter.
2. In the left panel, double-click the following:
   HKEY_CURRENT_USER>Software>Microsoft>Windows>CurrentVersion>Explorer>Advanced
3. In the right panel, locate the registry value:
   Hidden = "0"
4. Right-click on the value name and choose Modify. Change the value data of this entry to:
   Hidden = "2"
5. Again In the right panel, locate the registry value:
   HideFileExt = "1"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
   HideFileExt = "1"
7. Close Registry Editor.