Nope, you'd have to remove the parent 5603-folder. How 'bout 5604? Contents? Make sure that there's really no fu*ker-entry left.
Yep. So, except this one, there's no fu*ker to be found in the registry? After removal, reboot and try to access ur drives.
Ok. i have done that but after restarting the pc i check there is a new registry shows up.. Wat's next?
Was it there before removing the other entry or not? You really have to look closely, that thing is rebuilding itself as long as there is not every single entry 'bout it removed. Delete this one, check if another exists and reboot. Maybe try to boot into safe mode and then check your registry again.
• Boot up in safe mode, • check the registry for entries • and check especially -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx and HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce for suspicious entires/some you dunno what they/it mean/s.
sure.. The first 3 are the one u ask me to search.. I search for the fu*ker.vbs file and found some hiding in the drives.. PS: the connection here is fu*king slow!!
Your "runs" seem ok, nothing wrong with 'em. Pardon me, but how do you search your registry anyway? I dun believe that the drives autorun-entry wasn't there before ... ^^