• [ Kill the Process, Use Killbox if your Access Denied ]

[In Windows Vista Run As Administrator, After Execution System Will Restart]

• %Windows\system\explore.exe
• %Temp%\explore.exe
• %Windows Installed Drive\explore.exe
  If you have any of these files in running process from task manger, end the process before removal.
  Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg [ Right Click - Save Target As/Linked Content As ]
  Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.

• %Windows Installed Drive%\Documents.exe +  All Drives (D:, E:…)
  
• %Windows Installed Drive%\Photos.exe
• %Windows Installed Drive%\Games.exe
• %Windows Installed Drive%\Pictures.exe
• %Windows Installed Drive%\DC2.exe
• %Windows Installed Drive%\SYSTEMIL.EXE
  
• %Windows\SYSTEMIL.EXE [ 241.664 KB ]
  
• %Documents and Settings\All Users\Start Menu\Programs\Startup\SYSTEMIL2.EXE
  

If you have any of these files in running process from task manger, end the process before removal.
Note: if task manager is disabled
Download the following file [ Right click and select “Save Target as” ]
Click to Download - Enable Task.reg
Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.
Download UnHookExec.inf, [ Right click and select “Save Target as” ]
Save it to your Windows desktop. Do not run it at this time, download it only.
After booting into the Safe Mode or VGA Mode
Right-click the UnHookExec.inf file and click Install.
[This is a small file. It does not display any notice or boxes when you run it.]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Delete : SystemIL \SYSTEMIL.EXE
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Delete : SystemIL \SYSTEMIL.EXE
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Delete : NoFolderOptions
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
HideFileExt value: Change to 1 (If Value not 1)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced FolderContentsInfoTip value: Change to 1 (If Value not 1)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced PersistBrowsers value: Change to 0 (If Value not 0)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowInfoTip value: Change to 1 (If Value not 1)
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Delete : Start_ShowControlPanel
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Hidden value: Change to 1 (If Value not 1)
HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel
Delete : Homepage
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
Delete : NoFolderOptions
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
Delete : DisableTaskMgr
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
Delete : DisableRegistryTools
Delete Entry with any Listed file name Above
Search Registry For W32/VB.KI Worm File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

• [ Kill the Process, Use Killbox if your Access Denied ]
• %ProgramFiles%\common files\rising.exe
• %System%\53472fc0.exe
• %System%\rising.exe
• %Temp%\ravtmp\rising.exe
• c:\rising.exe
• %Temp%\[RANDOM 5 DIGITS].dll
• %System%\logo_1.exe
  
• %Windows Installed Drive\Recycle\RisinG.exe
• %Windows Installed Drive\recycle\x-5-4-27-2345678318-4567890223-4234567884-2341\RisinG.exe
  
• %Windows Installed Drive\recycle\x-5-4-27-2345678318-4567890223-4234567884-2341\Desktop.ini
  eg: C:\Recycle\RisinG.exe
• Removing the Folder Using Command Prompt
• Open Task Manager - End Process Explorer.exe
• in task manager - File - New Task, cmd press enter
• in Cmd, First type cd\ , to change the directory
  
• then it become c:\ , type C:\cd recycle , press enter
• then, C:\recycle\ then delete the exe file
• C:\recycle\del rising.exe , press enter to delete the file
• then type cd\ , press enter
  
• type c:\rd recycle , press enter to remove the recycle folder
• type exit , to exit command prompt
• type shutdown -r t 0 , to restart your pc
• This Trojan Can also use the following file names
  AF037A60.EXE, DC3.EXE, 9B1CC3AC.EXE, 22906838.DAT, RISING2008[1].EXE, DOWN(0).EXE, 60637142.EXE, 57597865.EXE, NEW.EXE, 13376637.SVD, ASDSDS.EXE, SDSDD.EXE, 42947858.EXE, KKKFUCKU.EXE, RISING[n].EXE, SDSDSD.EXE, RECYCLE/X-5-4-27-2345678318-4567890223-4234567884-2341/RISING.EXE
  If you have any of these files in running process from task manger, end the process before removal.
  Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg
  Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.