Manual Removal of Nvsc32.exe

Nvsc32.exe (Backdoor.IRC.Bot Trojan)
nvsc32.exe is a process which is registered as Backdoor.IRC.Bot Trojan. This Trojan allows attackers to access your computer from remote locations, stealing passwords, Internet banking and personal data. This process is a security risk and should be removed from your system.
Level of Danger: Medium
Distribution Level: Medium


Try Symantec Auto Removal Tool for Nvsc32.exe (Backdoor.IRC.Bot Trojan)
What the tool does
The W32.Bropia Removal Tool does the following:
Terminates the W32.Bropia processes
Deletes the W32.Bropia files
Deletes the registry values that W32.Bropia has added
View Instructions

Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 when your Screen turns on, Select Safe mode, press enter.

The Infected Files Can be Seen in these folders and names

• nvsc32.exe
  End Program Process before removal
  

Search registry for the above File name and remove,
Click Start, Run,Type regedit,then click OK.
Navigate to the key or Use Ctrl+f (Find Option) to find the below values:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\OLE
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Countrol\Lsa
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_CURRENT_USER\Software\Microsoft\OLE
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Countrol\Lsa

In the right pane, delete the values:

"win-xp" = "winis.exe"
"win-xp" = "nvsc32.exe"
"NvCplScan" = "nvsc32.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
NvCplScan = "nvsc32.exe"

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
NvCplScan = "nvsc32.exe"

HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Run
NvCplScan = "nvsc32.exe"

HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\RunOnce
NvCplScan = "nvsc32.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
NvCplScan = "nvsc32.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
NvCplScan = "nvsc32.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
NvCplScan = "nvsc32.exe"

Exit the Registry Editor.


Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)
Symantec (Shareware)