Cut the crap. The only serious and reliable way to remove a virus or worm is a complete reinstallation of your operating system. You didn't write the virus/worm (I assume) and therefore you have no way to tell what it does or what variants might exist.

What you are doing is treating symptoms.

I also found a hidden folder called Complete under C:\Documents and Settings\Your_User_Name that appeared to contain all the files that contained the virus. If this is indeed how the virus is spreading then everyone who had the virus needs to make sure to go to the library and stop sharing the Complete folder.

tattoowayne - if the real windows update does not do the trick i have a utilities disk i could copy for you. It is a miracle worker and just might work. If not i CAN get you a complete install win2k disk for free and 100% legal its NOT piracy. you just have to make sure you have a win2k key which you should. if you dont, talk to that guy who did your pc and if he wont give you one for the computer, which he HAS to legally, threaten to sue him, which you can. I hope the actual windows update site will work though.

i_have_no_account - for right now treating the symptoms is all we can do. And thats a load of bull about re-doing it all. I have removed many viruses in my days and ALL of the pc's ive done it on have the originally installed OS on them and are working perfect. so please keep your **** out of this forum where we really want to help people and not **** them off like you have me.

Guest With A Theory - yes if this folder does contain viral files not only should they be deleted but it is a good idea to stop sharing them over the gnutella and any other network your using at this time.

And PLEASE everybody go to that poll and vote as well as email me those files and the other people those files as stated in an earlier post. Thanks

kc0rkx_finch, your incompetence is neither appreciated nor will it be tolerated. People like you a security problem for the society. You, my dear friend, are not helping anyone at all. You may even cause serious trouble. Either you do not have any clue at all what you are talking about or you are actually spreading dangerous false information on purpose.

And no, whether people have a key or not, you have absolutely no right and no legitimation to copy Microsoft Windows 2000 installation media. What you are suggesting is clearly copyright infringement.

Furthermore, stop encouraging people to send you some of their files or run dubious programs of yours.

i followed all of your directions (which were very helpful, thank you) up to where i have to open regedit.exe. i copied it to the desktop, but when i double-click it a window that looks like the command prompt opens for a fraction of a second and then closes, and no window opens where i have to do all of the stuff with finding references to the bad file. What do I do???

Bussinator - Okay, try re-copying regedit to your desktop. If that doesnt work, open LW and look for the following file.
" 125894 regedit for LW prob "
That is a copy of MY regedit file, i imagine yours has been corrupted somehow. Just use doubleclick it after it opens up and follow the instrucions as posted.

I_have_no_account -

1. It is 100% perfectly legal to copy the install disk for ANY windows Operating System. If you have purchased a key for Win2k, why the crap should you have to fork over more money for another disk and another key which you dont need!!! I have been told by our local computer techs, which is where i got the disks, that its legal to copy the program but i cant give you a key. Eat that!
2. Quit falseifying the information that has been given here. For one I did NOT wrrite this info, Bobby Naini DID. I have posted that in the original instructions if only you were smart enought to read them. He knows i have used it here and kind of took over so dont throw copyright infringement in my face for that too! If there were some way i could ban you from posting here i would because you apparently have NO CREDIBILTY whatsoever. Look at all the other people here who have used these instructions and are happy with the results. As far as i can tell you are the only one who (A) hasnt used them at all and yet (B) youre knocking them before even trying them. I dont know who you think you are coming here and telling everyone that you have to reformat a hard drive to get rid of a virus when really you just sound like an amatuer who knows absolutely nothing about pc's and just wants to annoy people. What do you think antivirus systems do, tell you they removed the virus and reformated youre hard drive without youre knowledge. NO!!! they simplify the process of removing viruses by doing everything we are doing here in an automated process. Only thing is antivirus companies miss stuff too and turns out this one hasnt spread enough for them to notice it yet so thats what were trying to prevent. If you want to say something to me or cuss me out go ahead. Either get yourself kicked off of here or do it in private where innocent bystanders who dont give a hoot dont have to read it too. Please feel free to email me with all the 4 and 5 letter words you want. Id be more than happy to read it. If you really think you actully have some credibility at least ry helping the people here instead of hurting them.

All - sorry bout that little spat but scum like him make me angry. Anyway, please as i have posted before go to the other forum (link above in another of my posts) and vote on the instructions given here. You might also send BoobyNaini a PM and tell him thanks for writing the original instructions. Cya

kc0rkx_finch, you're like these wonder doctors you claim they can heal even cancer and tell their patients that they do need to go to a hospital. Unfortunately, you cannot "reinstall" a human's software or hardware. It's very easy to do this with a computer and it's the only reasonable way to get rid of an infection.

I do not need a single bit of credibility as I'm not telling any fairy tales or things you-just-have-to-believe. These are nothing but hard facts and the plain truth. If you don't trust me ask an independent expert - not some script kiddie or someone working for an AV tool vendor.

Giving a recipe without even diagnosing the problem at hand is anything but respectable.

Regarding the Win2k CD: No you have no permission to give away copies of the installation media. In any case, you'd have to check whether the receiver has a license first and that's something you cannot do. If you so certain about your words, then share the Win2k on Gnutella or put in on your web server. Only people with a key will be able to use it, right?

I'll give you a hint: The key is only half-baken technical protection because many people do not care about copyrights and copyrights only work in the court not in the wild.

There are also different license models and Windows versions. For example, if you have a OEM version, you have no permission to use the server version etc. Your offer is highly questionable in any case - even when you ignore the copyright issues. At least, I don't install operating systems
- or any software whatsoever - offered by anonymous random people at a web forum.

This is malware has been identified as
Worm.Win32.VB.an, the "AN Worm", sometimes called the "Zodiak Worm".

I was able to obtain a sample of this malware. I got free trial versions of both Norton Anti-virus and Kaspersky Anti-virus from Downoad.com.

Norton's 6/22/2005 virus definition library misses this malware.

Kaspersky catches it and quarantines it.

http://www.download.com/3120-20_4-0.html?qt=kaspersky

Let us all know if you find any other anti-virus scanners that catch this worm. It might be a new variant, because Norton's website claims they've been able to catch this worm since October 2003.

I've submitted a sample to Norton.

TrendMicro's webserver gave me an internal error when I tried submitting it via their web form.

Sounds like were almost done here. If you would rather not follow the instructions and use the virus removal tool go ahead it should work just as well. Im glad its beggining to get caught and removed by antivirus companies. For some reason i think ive been hit again, My firewall has been crippled. I cant change any settings on it. as for I_have_no_account. Im not even going to bother answering you anymore. You havent a clue what youre talking about so just leave me alone. I will not answer you anymore and any emails you send will be treated as harrasment. It sounds like this forum thread is not going to be needed anymore anyways. Cya guys l8er and im glad i was able to help someone. Cya