ISSUE: When trying to Restart or Shut Down the computer, the display grays
out as normal, then returns back to the desktop.
This is usually seen after being logged onto
AOL (America Online) and having the computer lock up.
This is a password stealing virus written specifically for users of AOL.
After following the steps outlined below, make sure that the virus software, such as McAfee, Norton or other software, is up to date with the most recent virus definitions.
To verify whether you have this virus or not, complete these steps.
1.On your screen, locate and click the Start button. From the Start menu, point to Programs, then click Windows Explorer.
2.In the Exploring window, from the View menu, click Folder Options.
3.In the Folder Options dialog box, click the View tab.
4.On the View tab, in the Advanced settings box, locate and select Show all files for Hidden Files, then click OK.
5.In the Exploring window, from the Tools menu, point to Find, then click Files or Folders.
6.In the Find: All Files window, in the Named text box, type:
Msdos98.exe.
Verify that the Look In text box displays C:, then click Find
Now.
RESOLUTION:
1.Restart the computer in Safe Mode.
2.On your screen, locate and click the Start button. From the Start menu, point to Programs, then click Windows Explorer.
3.In the Exploring window, from the View menu, click Folder Options.
4.In the Folder Options dialog box, click the View tab.
5.On the View tab, in the Advanced settings box, locate and select Show all files for Hidden Files, then click OK.
6.In the Exploring window, from the Tools menu, point to Find, then click Files or Folders.
7.In the Find: All Files window, in the Named text box, type:
Msdos98.exe.
Verify that the Look In text box displays C:, then click Find
Now.
8.When the file(s) are found, from the Edit menu, click Select all.
Now, from the File menu, click Delete.
In the Confirm File Delete dialog box, click Yes.
9.Repeat the last two steps searching for the following files:
a.Uninstallms.exe (in the C:\Windows folder)
b.Mine.exe (in the C:\Windows\System folder)
c.Readme.txt (in the C:\Windows\System folder)
Note: The folders are included to ensure the correct files are deleted.
The files that need to be deleted are only installed into the listed folders.
10.Search for Win.ini.
When this file is found, from the File menu, click Properties.
11.In the Win.ini Properties dialog box, clear the Read-only check box, then click OK.
12.In the Find: Win.ini window, double-click the Win.ini file.
13.In the Notepad window, locate the line beginning with Run=, then type a semi-colon (;) infront of each line beginning with Run=.
14.Close the Notepad window and click Yes to save the changes.
15.On your screen, locate and click the Start button.
From the Start menu, click Run.
16.In the Run dialog box, type: Regedit, then click OK.
17.In the Registry Editor window, locate the following key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run.
18.In the right panel locate and select Windows="c:\msdos98.exe", then press the DELETE key on your keyboard.
19.In the Delete Registry Key dialog box, click Yes.
20.Close all the open programs, then on your screen locate and click the Start button.
From the Start menu, click Shut Down.
21.In the Shut Down Windows dialog box, select Restart, then click OK.
22.Allow the computer to start normally and the issue should be resolved.
Note: It is also recommended to update the virus software on your computer.
|