X-Message-Number: 13181 Date: Tue, 01 Feb 2000 22:21:57 -0800 From: James Swayze <> Subject: How to kill PrettyPark worm This is Norton Antivirus' site regarding this pesky worm. If you received this (PRETTYPARK.EXE) and opened it you must go here to learn what it does and how to kill it. It involves modifying a line in the system registry and deleting the file FILES32.VXD from the S:\WINDOWS\SYSTEM directory. Windows sees this file as a system file and won't let you delete it. To do so you must press F8 as windows begins to start. The choices to start in safe mode or command prompt and others will appear. Pick go to command prompt only. At the old DOS C:\ prompt type CD\WINDOWS\SYSTEM and press return. Type, dir FILES32.VXD, press enter. If you see "one file found" and FILES32.VXD listed you're in the right place. Type DEL FILES32.VXD. To see that it's really gone type, DIR FILES32.VXD again. I shouldn't be there anymore. Now reboot. http://www.symantec.com/avcenter/venc/data/prettypark.worm.html james -- "Quod de futuris non est determinata omnino veritas" NOSTRADAMUS 15TH Century Rate This Message: http://www.cryonet.org/cgi-bin/rate.cgi?msg=13181