Aliases
Affected Operating Systems
Recovery Instructions:
Please follow the instructions for removing worms.
Please read the instructions for removing worms.
Make a note of the names of the files you delete. You should delete any copies of Troj/Faith-A at the same time as you delete W32/Oror-A.
Windows NT/2000/XP
In Windows NT/2000/XP you will also need to edit the following registry key. The removal of this key is optional in Windows 95/98/Me.
At the taskbar, click Start|Run. Type 'Regedit' and press Return. The registry editor opens.
Before you edit the registry, you should make a backup. On the 'Registry' menu, click 'Export Registry File'. In the 'Export range' panel, click 'All', then save your registry as Backup.
Locate the HKEY_LOCAL_MACHINE key:
HKLM\Software\Microsoft\Windows\
CurrentVersion\Run\LoadCurrentProfile
and delete it if it exists.
There will also be another key in
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
which points to one of the files that you removed. You should also delete this reference.
Close the registry editor.
Removal of other files
The worm creates the following text files which you may wish to delete.
C:\Windows\def12x.dll
C:\Windows\rn3a.vxd
C:\Windows\Winfile.dll
C:\shares.txt