How to remove winbows.exe or the W32/Autorun-AAI worm
Description:
W32/Autorun-AAI is a worm that targets removable media. This worm typically spreads to your computer when you insert removable media such as flash drives, external hard drives, etc that have this infection on them. Once these devices are inserted, your computer will autoplay the autorun.inf and the worm will run, infecting your computer. Then if you insert any clean flash drives into your computer, the worm will infect those as well.
Once infected, the worm will create the file C:\Windows\Winbows.exe. It will then create the follow registry key to start itself automatically:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”windows” = “winbows.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”windows” = “imege.exe”
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”windows” = “picture.exe”
Manual Removal Instructions for W32/Autorun-AAI
End these processes if they exist:
Learn how to end processes
winbows.exe
picture.exe
imege.exe
Delete these files if they exist:
Lean how to remove files
C:\Windows\winbows.exe
C:\Windows\imege.exe
C:\Windows\picture.exe
Remove these Registry keys if they exist:
Learn how to remove Windows Registry entries
Warning: Editing the Windows Registry incorrectly can cause problems with your computer that may cause it not to operate correctly. Please edit the Registry only if you know what you are doing.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\”windows”
Leave a Reply