Win32.Sober.S-AD Removal Tool

The the virus creates the folder WinSecurity in the %WINDIR% folder and Drops the above files in it. It then executes the executable just dropped named%WINDIR%WinSecurityservices.exeThen executes%WINDIR%WinSecuritysmss.exeand finally%WINDIR%WinSecuritycrss.exeEach of these processes play a specific role :crss.exe examines if the registry keyHKLMSOFTWAREMICROSOFTWINDOWSCURRENT VERSIONRUN Windows = C:WINNTWinSecurityservices.exehas been deleted and rewrites it if this is the caseservices.exe starts searching the victim