How to remove W32.Imalag.A

W32.Imalag.A remover

W32.Imalag.A removal process

For remove W32.Imalag.A virus,please clean/delete all W32.Imalag.A infected files and Delete/Modify any values W32.Imalag.A added to the registry as following:
Once executed, the virus searches for the %Windir%\explorer.exe file and copies it as the following file:
%Temp%\exp1orer.exe

If the virus cannot find the %Windir%\explorer.exe file it then searches for and copies the file associated with Shell_TrayWnd as the following file:
%Temp%\exp1orer.exe

Note: Normally, the Explorer.exe process has a Windows class name Shell_TrayWnd.

It then infects the original file associated with Shell_TrayWnd as well as infect some randomly chosen .exe files. The infected file is increased in size by 24,576 bytes.

It also attempts to downloads data from the following Web sites:
[http://]gimalainew.narod.ru
[http://]tibetnew.hotbox.ru



For successful remove W32.Imalag.A virus,you may also need do as following:
1. Temporarily Disable System Restore .

2. Update the virus definitions. Reboot computer in SafeMode;

3. Delete the IE temp files,some W32.Imalag.A temp file exisit there.

4.If you failed to remove W32.Imalag.A,please go to our remove help forum:http://help.antiviruses123.com