Symantec Security Response has developed a removal tool to clean the following infections:

W32.Bofra.A@mm (renamed from W32.Mydoom.AI@mm)
W32.Bofra.B@mm (renamed from W32.Mydoom.AJ@mm)
W32.Bofra.C@mm (renamed from W32.Mydoom.AK@mm)
W32.Bofra.D@mm (renamed from W32.Mydoom.AH@mm)

The W32.Bofra@mm Removal Tool does the following:

- Terminates W32.Bofra@mm viral processes.
- Terminates the viral thread running under Explorer.exe.
- Deletes W32.Bofra@mm files.
- Reverses the changes made to the registry by W32.Bofra@mm.

Note: You must have administrative rights to run this tool on Windows NT/2000/XP

What to do:

· Download the FixBofra.exe file
· Save the file to a convenient location, such as your downloads folder or the Windows desktop, or removable media known to be uninfected.
· Close all the running programs before running the tool.
· If you are on a network, or if you have a full-time connection to the Internet, disconnect the computer from the network and the Internet.
· If you are running Windows Me or XP, then disable System Restore. Refer to the "System Restore option in Windows Me/XP" section later in this writeup for further details.

--------------------------------------------------------------------------------
Caution: If you are running Windows Me/XP, we strongly recommend that you do not skip this step.
--------------------------------------------------------------------------------

· Double-click the FixBofra.exe file to start the removal tool.
· Click Start to begin the process, and then allow the tool to run.
· Restart the computer.
· Run the removal tool again to ensure that the system is clean.
· If you are running Windows Me/XP, then re-enable System Restore.
· If you are using Active Desktop, you may need to restore it.
· When the tool has finished running, you will see a message indicating whether W32.Bofra@mm infected the computer. In the case of a removal of the worm, the program displays the following results:
· Total number of scanned files
· Number of deleted files
· Number of repaired files
· Number of terminated viral processes
· Number of fixed registry entries