Task manager and regedit will not stay open.

  • Thread starter Thread starter Tom Koller
  • Start date Start date
T

Tom Koller

This is a virus I found. I don't know where it came from. The obvious
symptoms are in the subject line. Verification is easy. Just look for
the file imn32.exe in you winnt/system32 directory. If you have it, you
have it. File properties say it is from Microsoft and it have a version
number and all, but it is not digitally signed by Microsoft.

Removal is easy. It is in use and protected, so restart with advanced
startup options and select 'Safe Mode with Command Prompt' (it's hard to
beat DOS :) ). It will be a hidden file. so change the attributes and
delete it. Then restart and search the registry for inm32 and delete it
from the RUN folder.

That's all folks!

PS: I hate Micro$lop and use Mozilla!
 
This is a virus I found. I don't know where it came from. The obvious
symptoms are in the subject line. Verification is easy. Just look for
the file imn32.exe in you winnt/system32 directory. If you have it, you
have it. File properties say it is from Microsoft and it have a version
number and all, but it is not digitally signed by Microsoft.

Removal is easy. It is in use and protected, so restart with advanced
startup options and select 'Safe Mode with Command Prompt' (it's hard to
beat DOS :) ). It will be a hidden file. so change the attributes and
delete it. Then restart and search the registry for inm32 and delete it
from the RUN folder.

That's all folks!

PS: I hate Micro$lop and use Mozilla!
Click to expand...
This also seems to affect msconfig.
 
The Klez virus will do the same thing. In fact, Klez MAY have deposited
said IMN32.exe file.

After doing your removal, I strongly suggest doing what Symantec says on
their website for removing the virus. They have a removal tool that runs in
safe mode.

Found this on a friends computer, and there were over 100 instances of Klez
found and removed.
Click to expand...
Thanks for the info. I ran the scan and found nothing. So either it was
on my PC only once, or I vapped it manually with the steps I wrote out.
Since I know within a couple of hours when I got it, one 'copy' is very
possible.
 
Back
Top