Destrukto Virus Removal
To manually remove this virus, do the following: 1. Download a replacement to task manager such as Process Manager by Sysinternals at http://www.networkworld.com/community/?q=node/4241. 2. Open a command prompt window and go to windows\system32 and get ready to rename WSCRIPT.EXE by typing rename WSCRIPT.EXE WSCRIPT.TMP (or delete it). 3. Run Process Manager and kill the WSCRIPT process and then run the rename or delete command on the WSCRIPT.EXE. 4. Once WSCRIPT.EXE is renamed or deleted, you will most likely get a Windows message that system files are changed or deleted. Cancel the dialog box when prompted. The script will no longer be able to pop up the DESTRUKTO Internet Explorer page. 5. Download a registry editor such as mpam4_regedit_xp from http://www.patheticcockroach.com/mpam4/ind...?p=61&id=14. 6. Run the registry editor and reverse the key changes the virus made. Change them back so everything is enabled: ran.regwrite "HKCU\Software\Microsoft\Internet Explorer\Main