Backdoor.Netbus.444051 - Removal

To remove this Trojan, you need to:

• Scan for virus and then delete files detected as infected with this Trojan.
• Remove the value added to the RunServices registry key.
• Delete the file added by the Trojan.
  

See the sections that follow for detailed instructions.

To scan for viruses:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and then run a full system scan, making sure that NAV is set to scan all files.
3. If any files are detected as Backdoor.Netbus.444051, then click Delete.

To edit the registry:

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following subkey:
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
   
4. In the right pane, locate the Netbus Server Pro value. In the second column, just to the right of this value, note the path and file name that it refers to. Write this down.
5. Select the Netbus Server Pro value, press Delete, and then click Yes to confirm.
6. Click Registry and click Exit to save the changes and close the Registry Editor.
7. Restart the computer.

To delete the file:

1. Start Windows Explorer, and browse to the location that you wrote down in step 4 of the previous section.
2. Locate and select this file, press Delete, and then click Yes to confirm.

Technical Details