Hello,
This could be the Swen virus.
Norton has good information about this virus at:
http://securityresponse.symantec.com/avcenter/venc/data/[email protected]
1. Boot into "Save Mode with Command Prompt"
2. log on as administrator
3. type "regedit.exe" from the command line
4. write down the value of default key (this is the name of the virus file)
HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command
5. edit the default value in
HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command
it should be exactly: "%1" %*
6. (optional) remove the permissions from the
HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\open\command
key, and add everyone with ONLY read access to prevent future
reinfections.
7. delete the virus file from c:\windows\<the file name of the virus> and
c:\windows\prefetch\<the file name of the virus>
8. reboot the computer in normal mode, run antivirus update, and clean the
computer
with 3rd party antivirus program.
--
Robert Mitchell
Windows NT4&2000 MCSE
Microsoft Enterprise Support
Search our Knowledge Base at
http://support.microsoft.com/directory
Visit the Windows 2000 Homepage at
http://www.microsoft.com/windows2000/default.asp
See the Windows NT Homepage at
http://www.microsoft.com/ntserver/
NOTE: Please reply to the newsgroup and not directly to me. This allows
others to add to and benefit from these threads and also helps to ensure a
more timely response. Thank you!
This posting is provided "AS IS" without warranty either expressed or
implied, including, but not limited to, the implied warranties of
merchantability or fitness for a particular purpose.
The views and opinions expressed in this newsgroup posting are mine and do
not necessarily express or reflect the views and / or opinions of Microsoft.
