W32.Cervivec.A@mm

各ICQ用戶請注意近日有一個名為W32.Cervivec.A@mm既病毒流傳呢隻病毒會由email散播. 受害者會收到一封由自己朋友send來既email標題為Joke, 內容係"Hi, I have some cool joke - worms so have a look at it (no virus)"並附有一個叫worms.zip. 郵件上更有呢個friend既ICQ nickname簽名只要一執行呢個叫worms.zip既檔案畫面就會出現以下情況

之後就會受到感染中毒後, 呢個病毒會自動搜索電腦裏面有冇安裝ICQ, 如果有的話, 佢會自動Send包含此病毒既email去list上面既人. 呢個病毒只會起第一次執行時畫面出現"蟲蟲", 重新開機後會好似以前一樣冇中毒咁. 唔好俾佢欺騙, 其實呢個病毒每次開機都會自動執行, 而且會搵ICQ list上面既人, 同自動send email俾佢預防方發: 如果收到由朋友send黎既email而標題叫"Joke"千祈唔好打開. 裏面有個叫Worms.zip既檔案, 千祈唔好開, 連email一齊delete左佢. 中毒後如何處理: 如果你真係咁不幸中左招, 首先用最新版本既防毒程式scan電腦一次, 將病毒瞄掃出來(多數清除唔到), 清除到就直接清除, 清除唔到的話請到
http://securityresponse.symantec.com/avcenter/venc/data/w32.cervivec.a@mm.html
依照指示去做

To remove this Worm: ( 最好有install NAV 啦，冇任何anti-virus的話，format自殺啦（如果唔識．．講笑）

1. Remove the value that the worm added to the registry.
2. Restart the computer.
3. Run a full system scan and delete all files that are detected as W32.Cervivec.A@mm.

To edit the registry:
CAUTION: We strongly recommend that you back up the registry before you make any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify only the keys that are specified. Read the document How to make a backup of the Windows registry for instructions.

1. Click Start, and click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
4. In the right pane, delete the following value:

Kernel Loader %Windows%\System32\ntkrnl.exe -LOADDRIVER=TRUE

5. Click Registry, and click Exit.
6. Shut down the computer, wait thirty seconds and then restart he computer. (Do not skip this step).