hakaglan.worm

other Names of the worm :Worm.Win32.AutoIt.e, W32/Cocung.worm,W32.Imaut.N, Worm/Hakaglan, W32/SillyFDC-G..

This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It drops copies of itself. It creates registry entries to enable its automatic execution at every system startup. It modifies registry entries to enable its automatic execution at every system startup.

It creates registry key(s)/entry(ies). It drops copies of itself in all removable drives.

It disables Task Manager and registry tools. It connects to Web sites to download a file, As a result, routines of the downloaded worm are also exhibited on the affected system.

It creates a scheduled task.

Solution

Important Windows ME/XP Cleaning Instructions

Users running Windows ME and XP must disable System Restore to allow full scanning of infected computers.

Users running other Windows versions can proceed with the succeeding solution set(s).

Restarting in Safe Mode

This malware has characteristics that require the computer to be restarted in safe mode. Go to this page for instructions on how to restart your computer in safe mode.

Enabling The Registry Editor

This malware disables the Registry Editor. To restore the said system tool, perform the following instructions:
• On Windows 98 ME, NT, and 2000:

1. Open Notepad. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableRegistryTools" = dword:00000000

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

• On Windows XP and Server 2003:

1. Open the Run dialog box. Click Start>Run, type Notepad, then press Enter.
2. Copy and paste the following:

REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f

3. Save this file as C:\RESTORE.REG.
4. Click Start>Run, type C:\RESTORE.REG, then press Enter.
5. Click Yes at the prompt of the message box.

Removing/Restoring Autostart Entry from the Registry

This solution deletes/modifies registry keys/entries added/modified by this malware. Before performing the steps below, make sure you know how to back up the registry and how to restore it if a problem occurs. Refer to this Microsoft article for more information about modifying your computer's registry.

1. Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
2. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>
Windows>CurrentVersion>Run
3. In the right panel, locate and delete the entry:
Yahoo Messengger = "%System%\RVHOST.EXE"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP and Server 2003.)
4. In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>
Windows NT>CurrentVersion>Winlogon
5. In the right panel, locate the entry:
Shell = "Explorer.exe RVHOST.exe"
6. Right-click on the value name and choose Modify. Change the value data of this entry to:
Explorer.exe

Removing Added Entries from the Registry

1. Still in Registry Editor, in the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Explorer>WorkgroupCrawler>Shares
2. In the right panel, locate and delete the entry:
shared = "\New Folder.exe"
3. In the left panel, double-click the following:
HKEY_CURRENT_USER>Software>Microsoft>Windows>
CurrentVersion>Policies>System
4. In the right panel, locate and delete the entry:
DisableTaskMgr = "1"

Deleting the Malware File(s)

1. Right-click Start then click Search... or Find..., depending on the version of Windows you are running.
2. In the Named input box, type:
%Windows%\tasks\AT1.JOB
(Note: %Windows% is the Windows folder, which is usually C:\Windows or C:\WINNT.)
3. In the Look In drop-down list, select My Computer, then press Enter.
4. Once located, select the file then press SHIFT+DELETE.

Restart your computer normally before performing the following solution.

Full Scan with nod32 with full updates or use Avira anti virus

Hope this helps yhanny