Backdoor.Bionet.40a - Removal

To remove the Backdoor.Bionet.40a, please follow the instructions in the order given.

To remove the Trojan:

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
3. Delete any files detected as Backdoor.Bionet.40a. What you do next depends on whether NAV was able to delete files that it detected as infected with Backdoor.Bionet.40a:
• If NAV was able to delete all the files that it detected as infected, go to the section To edit the registry.
• If NAV was not able to delete all files that it detected as infected, go on to the next section and see the instructions for your operating system.

To remove files that cannot be deleted by NAV:
Follow the instructions for your version of Windows only if NAV could not delete files that it detected as infected with Backdoor.Bionet.40a.

• Windows 95/98/Me
  1. Restart the computer in Safe Mode. For instructions on how to restart in Safe Mode, see the document How to restart Windows 9x or Windows Me in Safe Mode.
  2. Run the scan again, and delete any files detected as Backdoor.Bionet.40a.
  3. When the scan is finished, go on to the section To edit the registry.
• Windows NT/2000
  1. Press Ctrl+Alt+Delete one time.
  2. Click Task Manager.
  3. Click the Processes tab.
  4. Click the "Image Name" column header two times to sort the processes alphabetically.
  5. Scroll through the list and look for Procmon.exe. If you find the file, click it and then click End Process.
  6. Close the Task Manager.
  7. Run the scan again, and delete any files detected as Backdoor.Bionet.40a.
  8. When the scan is finished, go on to the section To edit the registry.

To edit the registry:

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Please make sure you modify only the keys specified. Please see the document How to back up the Windows registry before proceeding.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the key
   
   HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
   
4. In the right pane, delete the value
   
   procmon
   
5. Close the Registry Editor.

Technical Details