*important* REALPHX.COM WORM
Okay well I have noticed that a third of the people on my buddylist have fallen victim to the R E A L P H X. C O M worm. It will rewrite your AIM profile with the URL R E A L P H X. C O M . Do not click it...here are removal instructions:
Realphx dot com worm
October 10, 2003
Removal Instructions
1) Reboot your computer in Safe Mode
a) Reboot the computer
b) Just before Windows begins to load, press F8
c) Select Safe Mode
2) Click on Start/Search/For Files or Folders...
3) Enter 'av'.
4) Delete any files named 'av' or 'av.exe'.
5) Click on Start/Run...
6) Enter 'regedit'.
7) Browse to 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Run'
8) Delete the 'Antivirus' Key with a value of 'c:\av.exe'
9) Browse to 'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{Random Numbers}\FilesNamedMRU'
10) Delete the '000' Key with a value of 'av.exe'
11) Close Regedit.
12) Click on Start/Control Panels.
13) Double-click on the Internet Options control panel.
14) Change your default home page.
15) Reset your buddy profile in AIM.
16) Reboot your computer.
Taken from:
http://www.antivirus.vt.edu/avnews/a....asp#article20
We now return to your regularly scheduled program
Realphx dot com worm
October 10, 2003
Removal Instructions
1) Reboot your computer in Safe Mode
a) Reboot the computer
b) Just before Windows begins to load, press F8
c) Select Safe Mode
2) Click on Start/Search/For Files or Folders...
3) Enter 'av'.
4) Delete any files named 'av' or 'av.exe'.
5) Click on Start/Run...
6) Enter 'regedit'.
7) Browse to 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Cur rentVersion\Run'
8) Delete the 'Antivirus' Key with a value of 'c:\av.exe'
9) Browse to 'HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{Random Numbers}\FilesNamedMRU'
10) Delete the '000' Key with a value of 'av.exe'
11) Close Regedit.
12) Click on Start/Control Panels.
13) Double-click on the Internet Options control panel.
14) Change your default home page.
15) Reset your buddy profile in AIM.
16) Reboot your computer.
Taken from:
http://www.antivirus.vt.edu/avnews/a....asp#article20
We now return to your regularly scheduled program


