Related Resources • Virus Encyclopedia • Glossary of terms

Elsewhere on the Web • F-Secure Description

As of Monday, May 19th, 2003, most antivirus vendors had published signature updates capable of detecting the worm. Additionally, both Symantec and F-Secure had released free removal tools for the Sobig variant, a.k.a. Palyh and Mankx.

Symantec free removal tool.

F-Secure has established a Global Information Center with detailed information and geographical infection map for the worm, as well as providing a free removal tool.

Manual Detection and Removal
The following instructions involve modifying the System Registry. Improperly editing the system registry can adversely affect the operating system.

Search the System Registry for the following keys and delete them:

Under the keys:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
look for and delete the key value:
System Tray = %windir%\msccn32.exe

Copies of the Palyh worm are dropped to:

C:\%windir%\msccn32.exe
Windows\All Users\Start Menu\Programs\StartUp\msccn32.exe
Documents and Settings\All Users\Start Menu\Programs\Startup\msccn32.exe