Removal Instructions for Keypanic.Trojan

    4Help provides these instructions to assist you in the removal of this computer virus.  If these instructions do not remove the virus from your system, then 4Help recommends that you contact your computer vendor.  The use of up-to-date anti-virus software will help prevent your computer from becoming infected with viruses.

What you need to complete these instructions:

• WinKill software (available below)

• Norton AntiVirus installed on the infected computer   

  If you don't have Norton AntiVirus installed, click the following link to download it:

           http://antivirus.vt.edu/download/default.asp 

Time to complete:     15 minutes

Virus removal:

Overview:

• Run the WinKill software to disable virus
• Repair the Windows registry
• Update your virus definitions
• Scan your computer with Norton Antivirus

1. You MUST print these instructions before you proceed with the virus removal. You will need the printed instructions because your computer may not boot into Windows during parts of the repair process.
• Select 'Print...' from the 'File' menu.
2. Download WinKill by clicking on the following link:

   http://4help.vt.edu/software/utilities/utilities_w/winkill.exe

   • If you are using the infected computer, save the file to your 'Desktop'.
   • If you are using a different computer from your own to follow these instruction, save the program to a clean blank floppy disk.
3. Install WinKill:
   1. Double click on the 'winkill.exe' executable.
   2. Click 'Next >' on the 'WinKill Setup' window.
   3. Click 'Next >' on the 'Choose Destination Location' window.
   4. Click 'Next >' on the 'Select Program Folder' window.
   5. Click 'No' to answer 'Would you like to add WinKill to your Startup Group?'.
4. Click on 'Start/Programs/MS-DOS Prompt' to open the 'MS-DOS Prompt'.
5. Type cd \progra~1\winkill, then press 'Enter'.
6. Type winkill -kp datcheck.exe, then press 'Enter'.
7. Close the 'MS-DOS Prompt' window.
8. Click 'Start/Find/Files or Folders...' to open the 'Find: All Files' window.
9. Type datcheck.exe.
10. Select your C: drive from the 'Look in:' drop-down list.
11. Click 'Find Now'.
12. Right click on 'Datcheck.exe' under 'Name' and select 'Delete' from the pop-up menu.
    • Click 'Yes' if you are prompted by a 'Confirm File Delete' dialogue box.
13. Close the 'Find: Files' window.
14. Click 'Start/Run...' to open the 'Run' window.
15. Type regedit in the 'Open:' text box.
16. Make a backup of your Registry:
    1. Select 'Export Registry File...' from the 'Registry' pull-down menu.
    2. Choose your C: drive from the 'Save in:' drop-down list.
    3. Type backup in the 'File name:' text box.
    4. Click 'Save'. 
17. Select 'Find...' from the 'Edit' pull-down menu.
18. Type datcheck in the 'Find what:' text box.
19. Click 'Find Next' and Windows will begin searching the Registry.
20. After a few moments, an entry labeled 'DATCHECK' should be highlighted on the right side under 'Name'.
    • Right click on 'DATCHECK' and select 'Delete'.
    • Click 'Yes' to answer 'Are you sure you want to delete this value?'.
21. Close the 'Registry Editor'.
22. Use your virus scanner to detect the executable which contained the Keypanic.Trojan program.
    • Update your anti-virus software:
      • If you are using Norton Anti-Virus, run LiveUpdate.
      • If LiveUpdate doesn't work, download the updates from http://antivirus.vt.edu/download/definitions.asp
      • If you don't use Norton and are unsure how to update your anti-virus software, consult the software's help documentation.
     
    • Run a full system scan with your anti-virus software: 

      a. If you are using Norton AntiVirus 2000:

      • Click 'Start/Programs/Norton AntiVirus/Norton AntiVirus 2000'.
      • Click 'Scan for Viruses' in the Norton AntiVirus window.
      • Select 'Scan all hard disks for viruses'.
      • Click on 'Run Scan Now'.
      • This scan may take several minutes or hours to complete.
      b. If you are using Norton AntiVirus Corporate Edition 7.x:
      • Click 'Start/Programs/Norton AntiVirus Corporate Edition/Norton AntiVirus Corporate Edition'. 
      • If there is a '+' next to the word 'Scan', click on the '+'. Otherwise, continue to the next step. 
      • Click once on 'Scan Computer'. A list of your hard drives will appear in the right side of this window. 
      • Click on the empty box next to the drive you wish to scan. A green plus and a checkmark will appear in this box. 
      • Click the 'Scan' button.
       

Known Issues:

• If these instructions did not repair your system, then 4Help recommends you contact a computer vendor for further assistance.