Microsoft Windows XP Professional and Microsoft Windows XP Home Edition
a. Right-click My Computer, and then click Open.
b. On the Tools menu, click Folder Options, and then click the File Types tab.
c. In the Registered file types list, click Registration Entries, and then click Change.
d. In the Programs list, click Registry Editor, and then click OK.
Note If Registry Editor does not appear in the Programs list, follow these steps:1. Click Browse, and then click My Computer in the Look in list.
2. Double-click Local Disk (C
, and then double-click WINDOWS.
3. Click regedit.exe, and then click Open.
4. Click OK, and then click Close.
3. Create a .reg file that is named Repair.reg to repair the registry. To do this, follow these steps:a. Right-click an empty area on the desktop, point to New, and then click Text Document.
b. Press ENTER.
c. Double-click New Text Document.txt, and then paste the following in the document:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\System] "DisableRegistryTools"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\CLASSES\exefile\shell\ open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\batfile\shell\ open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\comfile\shell\ open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\piffile\shell\ open\command] @="\"%1\" %*"
[HKEY_LOCAL_MACHINE\Software\CLASSES\scrfile\shell\ open\command] @="\"%1\" %*"
d. On the File menu, click Save As.
e. In the Save in list, click Desktop.
f. In the File name box, type Repair.reg.
g. In the Save as type list, click All Files.
h. Click Save.
i. Double-click Repair.reg on the desktop, click Yes, and then click OK.
4. Update the virus definitions of the antivirus software that is installed on your computer. To do this, scan your computer with the antivirus software, and then follow the instructions for removing this worm.
5. Use Task Manager to remove any file that the Swen worm created to run as a background system process. To do this, follow these steps:a. Right-click the taskbar, and then click Task Manager.
b. Click the Processes tab.
c. Click the Image Name column header to alphabetically sort the processes.
d. Scroll through the list of processes, and look for any randomly-named values that the worm created, such as "ZNFUL."
e. If you locate a randomly-named value, click it, and then click End Process. In the Task Manager Warning dialog box, click Yes.
f. Exit Task Manager.
6. Restart your computer after you remove the worm.