How to remove the W32.IRCBot messenger virus
Based on info by Symantec Security Repsonse
Step 1: Killing the process
- Press Ctrl + Alt + Del to bring up the windows task manager
- Click on the processes tab (if you are using an older version of Windows, eg: Windows 98. Do not worry about this step
- Scroll down to the process: winapii.exe, and click End Process (or End Task for older versions of windows
Step 2: Removing the files
- Navigate to where Windows is installed on your hard drive (Usually C:\Windows)
- Find and delete the folder named: Winapii
Step 3: Fixing the registry
- Open your registry editor (Start > Run > regedit.exe) and navigate to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"
- Delete the key named winapii
(For a small tutorial on this, go to this site, because deleting the wrong keys could corrupt Windows).
Step 4: Finalising the removal
- Clean out your recycle bin to totally remove the files from your HDD.
- Do a complete system scan of your system to make sure that no other files have been infected
I liked the way cookie wrote the block checker removal instrucions, so i used it as a template.
/ 
