How to Delete the NLSDL.EXE Virus

The NLSDL.exe virus, alternatively knows as the worm.Win32.VB.ck virus, pretends to be a critical Microsoft Windows file. The fake NLSDL.exe will open when your computer boots up. The file then will connect to a remote server and attempt to download malicious files. To remove the virus from your system, you will need to delete several files it copies to your computer's hard drive.

Difficulty: Moderate

Instructions

Things You'll Need:

• Antivirus software utility

1. Navigate to the AVG website if you don't already have an antivirus utility installed on your computer. Download and run the installation file for the antivirus utility.

2. 
   Accessing Safe Mode

   Restart your computer and wait for the logo of your computer's manufacturer to appear on the monitor. Press the F8 key to bring up a new menu.

3. 
   Opening the Search Box

   Scroll down to the "Safe Mode" option and press Enter. Bring up the Start menu once the operating system finishes loading. Click on the "Search" option.

4. Type the phrase "6d4e036f-cb53-4ebb-9c47-fdc78b67be70.exe" into the Windows Vista search box. Right-click on the file and choose the "Delete" option. Search for and delete the "worm2007.exe" file.

5. Search for "NLSDL.exe." Look through the files that appear and find the version that is not in the Windows folder. The fake version will be installed into a random folder other than Windows. Right-click on the file and delete it.

6. Search for "regedit" and double-click the registry editor's icon when it appears in the search results. Click on the folder HKEY_CURRENT_USER.

7. Navigate through the subfolders Software, Yahoo and Pager to get to View. Right-click and delete the folders YMSGR_Launchcast and YMSGR_buzz.

8. Close the registry editor's window. Make sure your antivirus definitions are up to date and run a full system scan.

9. After the virus scan is completed, restart your computer.

Tips & Warnings

• Starting the computer in Safe Mode prevents the fake version of NLSDL.exe from running. If you don't start the computer in Safe Mode, you won't be able to delete the virus files. Some brands of computers use a button other than the F8 key to access boot menu. You may have to press F2 or F10 or Delete instead. Consult your documentation or watch the screen carefully for instruction on how to enter Setup. If you are using Windows XP, you can access the registry editor by clicking on "Run..." in the Start menu and entering "regedit" in the "Open..." box. You can search for the virus files by clicking on "Search" in the Start menu.
• The registry editor is used to store files your computer needs to load its operating system. You may want to create backup copies of any important files on your computer before accessing the registry editor. If the wrong entries are accidentally deleted. you might need to reinstall your operating system.

References

• NLSDL.EXE / Win32.VB.ck Virus
• Win32.VB.CK Information
• NLSDL File Process Infromation

Resources

• AVG Free Anti-Virus