===== W32.Silly Removal =====
  - Discover the worm. Notice suspicious services in task manager and locate their executables. Useful tool: Process Explorer from [[http://technet.microsoft.com/da-dk/sysinternals/bb896653(en-us).aspx|sysinternals.com]] or a command line version [[http://www.computerhope.com/download/winxp/tasklist.exe|tasklist.exe]]
  - Location c:\windows\system\svchost.exe and c:\windows\system\_sv_scv_\_U_.exe (backup)
  - Remove start entry from registery: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon
  - Safe boot
  - Remove with: del /a:h /f svchost.exe (attribute:hidden force) 
  - Alternative solution schedule file for deletion on next reboot with [[http://msdn2.microsoft.com/en-us/library/aa365240(VS.85).aspx|MoveFileEx]] (Didnt work for me) Dr Delete is available to do the trick [[http://www.dslreports.com/r0/download/387897~efbe5f139ddc8d43a72aff9cc6340c23/DrDeleteExeandSourceRARSFX.zip|here]]