[email protected]

Someone on another list posted this remedy for the email worm. It is
exactly the process I went through and it worked perfectly.

Kris



To create a boot disk under Windows 95,98 or ME.

Click on the Start button, click on Setting and select Control Panel. A
window will open with a number of program icons. Click on Add/remove
programs. Click on the tab that says "Create Disk". Click on the button
that says, "Create bootdisk". This will create a bootable floppy.
Follow the directions to create the disk. You will need a blank floppy
that will become the Windows Boot Disk.

After the boot disk has been created, put the floppy in the disk drive
and reboot the computer (Start, shutdown, reboot). As the computer boots
off the floppy, it will present a menu. Select Command prompt/minimum
boot.

After a short while you should see "C:\". "Type in "cd \windows\"
without the quotes and then press enter.
Type "dir inetd.exe" and then press enter.
You should see the following.

c:\windows\>dir inetd.exe

Volume in drive C is unlabeled Serial number is 1569:1BE4
Directory of C:\WINDOWS\inetd.exe

4-20-01 1:17 14 inetd.exe
14 bytes in 1 file and 0 dirs 4,096 bytes allocated
4,585,545,728 bytes free

Now type "del inetd.exe" and then press enter
You should see the following.

c:\windows\>del inetd.exe
Deleting C:\WINDOWS\inetd.exe
1 file deleted

c:\windows\>

Do the same for kern32.exe.

Now you need to edit the win.ini file.

Type in "edit win.ini" and press enter.
You should see the second line say:
[windows]
run=c:\windows\kern32.exe
or
run=c:\windows\inetd.exe
Remove the text to the right of the = sign, so that the line now reads
run=

This will stop the worm from running. Remove the floppy disk and reboot
the PC.
You may see some error messages stating that indetd.exe or kern32.exe can
not be found.
This is a good sign as it means you have deleted the worm.

Now we need to delete the windows registy entries that have inetd.exe or
kern32.exe.

1. Click Start, and then click Run. The Run dialog box appears.
2. Type regedit and then click OK. The Registry Editor opens.
3. Navigate to the following subkey:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce


4. In the right pane, delete the following value:

Kernel32 KERN32.EXE

5. Click Registry and then click Exit to save the changes.

Congratulations, you have removed the worm from your Computer!

________________________________________________________________
GET INTERNET ACCESS FROM JUNO!
Juno offers FREE or PREMIUM Internet access for less!
Join Juno today! For your FREE software, visit:
http://dl.www.juno.com/get/tagj.