How to Remove the Patched User32 Virus

Preparation and Safe Mode
1. Write these instructions down on a notepad or piece of paper. Removing this threat will require multiple computer restarts and you may not be able to access this Web page again once the process has begun.
2. Download and install the Microsoft Malicious Software Removal Tool. MSRT is a free program developed by Microsoft to assist you in destroying virus and trojan infections.
3. Restart your computer by clicking 'Start' and 'Shut Down,' then selecting 'Restart.'
4. Press the 'F8' key repeatedly while your system reboots. This will trigger the Windows Advanced Options menu.
5. Select 'Safe Mode with Networking' and hit the 'Enter' key to load Windows in Safe Mode. Safe Mode is a protected operating environment that will allow you to tweak some settings that may have been guarded by the virus in normal Windows.
Disable System Restore and Fix Your Registry
6. Click the 'Start' menu and select 'Control Panel.' Double-click 'System' and choose the 'System Restore' tab.
7. Click the box next to 'Turn off System Restore.' System Restore is a safety mechanism that helps restore data in the event of a sudden crash or critical error but will work against you by accidentally repairing the files you destroy while removing W32/Mariofev.worm. Click 'OK' to save changes.
8. Open the Run prompt by clicking 'Start,' then 'Run.' Enter the command 'REGEDIT' and press 'Enter' to load the Windows Registry editor.
9. Press 'Ctrl' and 'F' simultaneously to load the search window. Enter 'SCNa' and press 'Enter' to find any entries by this name.
10. Right-click any registry entry that comes up with this search and click 'Delete.' This step ensures the virus cannot re-install itself after removal. Close the Registry editor when done.
Run MSRT and Remove the Threat
11. Open the Microsoft Malicious Software Removal Tool by double-clicking the icon on your desktop or selecting it in the 'All Programs' folder of your Start menu.
12. Click 'Next' to go to the 'Scan Type' window and select 'Full Scan.' While a quick scan will complete in less time, a full scan is recommended to ensure you remove all traces of W32/Mariofev.worm.
13. Click 'Next' to begin the scan. When complete, MSRT will show the results of your scan.
14. Remove any malicious files and folders discovered by MSRT by either allowing the software to removed them from your computer or by manual deletion. Be sure to empty your Recycle Bin.
15. Restart your computer. It should now be completely clear of W32/Mariofev.worm, and you will no longer receive alerts about the Patched User32 virus.