from I-Hacked.com forums
Surely by now you have heard of the Exploit-WMF virus making its rounds by now. I mean, even C-Net is reporting on it. Hell you may already be infected with it.

Cant get to
www.trendmicro.com
updates.symantec.com
www.nai.com
ect ???? Well lucky you .. you have the virus

Does your desktop look like this?
WMF Worm

1 - Well since you have windows - use the recovery - Go back a day
note: “you could lose some data” - you do have to reboot
Start - All Programs - Accessories - System Tools - System Restore
“I will let you figure out how to use it” I would go back at least a day

2 - Install a virus scanner - to pick up some of the backdoor crap on your pc.
I would use : AVG - hell its free
http://free.grisoft.com/doc/2/lng/us/tpl/v5

3 - Scan your pc

4 - Wow - that took a while - Next d/l counter spy

http://www.sunbelt-software.com/CounterSpy.cfm

“15 day - free trial” Make sure you update it first then scan

5 - Scan with Counter Spy - Remove all the crap it finds

6 - Download Spybot http://www.safer-networking.org/en/mirrors/index.html its free too

7 - Open Spybot - Run the update first then shut it down. DON’T SCAN YET

8 - Reboot your pc in safe mode - thats F8 when booting - I would use with network support.

9 - Ok now that you are in safe mode - Run spybot and do a scan.
remove all the SurfSideKick and CoolWWWSearch crap.

10 - ok lets not let this happen again so… click start run :
type REGSVR32 /U SHIMGVW.DLL this will stop the flaw in the os

11 - you are done for now. Look for more MS updates and new dats

oh yea you can get to www.mcafee.com , www.nai.com ect.. again…

Thanks Surbo for the excellent write-up!