trojan.win32.vb.kcd

Adopted from Ahmad Syahruddin's blog

Trick to remove trojan.win32.vb.kcd

The name was trojan.win32.vb.kcd. It has been made using VB 6.0. Some effects resulted of this virus are move all of your original .doc and .xls file to the C:\Windows\system32\MB and replace them with the file as your original file name but have the .exe extension.
Step by step to remove it is as follow:

1. Remove file C:\Windows\system32\MB\WORD.scr
2. Hit the (Win Button+R) and type regedit.exe to go to the registry editor
3. Point to the "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" see the right side on the value named WORD.scr
4. Terminate process named rstrui.exe through task manager. You can right click on the taskbar and select Task Manager
5. Remove file C:\Windows\system32\MB\rstrui.exe
6. Find the file which have extension .exe and 140 KB on capacity. That file have the Word icon. Remember to find the file that have hidden attribute by check the "find the hidden file" radio button on search criteria
7. If the file found, you should to delete them.

That's all the ways to eliminate the virus manually without any antivirus software. May it useful for you.

Thnks to Ahmad Syahruddin