Removal solution for PWSteal.Marlap.C

[DeMario]

Hi friends, I am using samsung laptop which is loaded with Windows Vista operating system. And my anti virus software program are displaying that your system are infected with PWSteal.Marlap.C virus. And I tried to remove this virus from my anti virus program but it is unable to delete this virus. And this virus made my machine tremendously slow. I want some good removal solution for this virus. Can any will tell me that how to remove this virus, please?

[Steve123]

PWSteal.Marlap.C generates the given file:

C:\Windows\PictureViewer.exe

And then run EJN[RANDOM NUMBER].tmp.

Now this virus insert the value:

"PictureViewer" = "C:\Windows\PictureViewer.exe"

to the registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

[Shen]

This virus asks the user to out the given data if an AOL client is installed:

1. Name
2. Account Number
3. Account Type
4. Address
5. ZIP
6. Phone number
7. PIN number
8. Birthday
9. Mother?123,456s Maiden Name
10. Social Security Number
11. Credit Card Number and its expiration date
12. Debit Card Number and its expiration date

[Big Fish]

This virus sends the collected information to the gen below Web site:

"http://]imform.coolinc.info/[REMOVED"

This virus also tries to remove %System%\taskmgr.exe.

Note:
%System% is a variable that refers to the System folder. By default this is C:\Windows\System

[Zachary]

There are some recommendation for PWSteal.Marlap.C:

• Isolate compromised computers quickly to prevent threats from spreading further. Perform a forensic analysis and restore the computers using trusted media.
• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.

[Spyrus]

Search and delete to the subkey:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Remove the value in the right panel:

"PictureViewer" = "C:\Windows\PictureViewer.exe"