Soft virus With Hard Action (songs.exe, khatarnak.exe pictures.exe )

.


The virus was reported by one of our readers and surprisingly this virus spreads under the names of songs.exe, khatarnak.exe and pictures.exe apart from others.
Steps to remove this virus:
1.    Turn off the System Restore.
2.    Boot in the Safe mode.
3.    Go to Add/Remove Programs and remove any programs referencing “W32/SillyFDC,” “Worm.IM.Sohanad” or “Khatarnak.exe (if any)
4.    Run Task Manager and kill the process (if any) relating to these exe
5.    Search the hard drive with the name corresponding to khatarnak.exe, songs.exe and pictures.exe etc.
6.    Type msconfig in the Run box and remove checkmarks next to any “Khatarnak.exe” or “XSafe.exe” entries on the “Startup” tab
7.    Run the Registry Editor and delete the following entries (if any):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\Security\”Security” = “[BINARY DATA]”
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\”Type” = “1″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\”Start” = “3″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\”ImagePath” = “%Windir%\Fonts\srskl.fon”
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\”ErrorControl” = “0″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srskl\”DisplayName” = “srskl”
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\Security\”Security” = “[BINARY DATA]”
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\”Type” = “1″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\”Start” = “3″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\”ImagePath” = “%Temp%\~dwphx.tmp”
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\”ErrorControl” = “0″
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DogKiller\”DisplayName” = “DogKiller”

8.    Reboot

 The virus should have gone