VBS.BubbleBoy - Removal

To remove this worm:

1. Delete the following files:
   
   C:\Windows\Start Menu\Programs\StartUp\Update.hta
   C:\Windows\Menú Inicio\Programas\Inicio\Update.
   
2. Restore the following registry keys to their proper values:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
   CurrentVersion\RegisteredOwner
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\
   CurrentVersion\RegisteredOrganization
   
3. Remove the following registry key:
   
   HKLM\Software\OUTLOOK.BubbleBoy\
   
   NOTE: Not removing this key will actually prevent the worm from propagating again.
   

Prevention Information

Microsoft has provided a patch to prevent the worm from propagating by viewing an infected email in Outlook. Security Response recommends downloading this patch from the following Web site:

http://www.microsoft.com/technet/security/bulletin/ms99-032.asp

Also, Symantec Security Response recommends monitoring the following Web site for any Microsoft security updates:

http://www.microsoft.com/security/default.asp

Technical Details