This problem may occur if the W32/Swen.A@MM (Swen) worm
installed itself on your computer when you installed a security update that you
received as an e-mail attachment to an unexpected e-mail that claims to be from
Microsoft.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756
(http://support.microsoft.com/kb/322756/
)
How to back up and restore the registry in Windows
Restart your computer in safe mode.
For additional information about safe mode in
Microsoft Windows 2000, click the following article number to view the article
in the Microsoft Knowledge Base:
202485
(http://support.microsoft.com/kb/202485/
)
Description of safe boot mode in Windows 2000
For additional information about safe
mode in Microsoft Windows XP, click the following article number to view the
article in the Microsoft Knowledge Base:
315222
(http://support.microsoft.com/kb/315222/
)
A description of the safe mode boot options in Windows XP
Change the file association for .reg files on your
computer. To do this, follow these steps.
Double-click Repair.reg on the
desktop, click Yes, and then click
OK.
Update the virus definitions of the antivirus software that
is installed on your computer. To do this, scan your computer with the
antivirus software, and then follow the instructions for removing this worm.
Use Task Manager to remove any file that the Swen worm
created to run as a background system process. To do this, follow these steps:
Right-click the taskbar, and then click Task
Manager.
Click the Processes tab.
Click the Image Name column header to
alphabetically sort the processes.
Scroll through the list of processes, and look for any
randomly-named values that the worm created, such as "ZNFUL."
If you locate a randomly-named value, click it, and
then click End Process. In the Task Manager
Warning dialog box, click Yes.