Win32.Auric.A@mm Removal Tool

SYMPTOMS:
- Fake DirectX error:
- All windows become red:
- Many empty text files on Desktop, called raVeNNNN (NNNN is a number)
- Unrequested web-page opened to www.offspring.com
- Text appended to current window title:
- "=:-) OFFSPRING is co0L =:-) PUNKS NOT DEAD =:-)"
- Antivirus/firewall processes terminated
- Delay on opening executable files
Removal instructions:
-> Download the removal archive and and run extfix.reg to remove executable file association with the worm file, *or* mannually edit the keys:
Key: HKEY_LOCAL_MACHINESoftwareClassesexefileshellopencommand
Value:
Replace with: %1 %*
Key: HKEY_CLASSES_ROOTexefileshellopencommand
Value:
Replace with: %1 %*
-> Then use our removal tool. The Win32.Auric.A@mm Removal Tool does the following:
- Kills the worm processes
- Deletes the worm files that would run at startup
- Corrects the executable file associations
- Restores the windows colors to normal
- Deletes the empty RAVE???? text files from desktop
- Deletes the HKEY_LOCAL_MACHINESoftwareraVe keys
- Deletes the %SystemDir%ravec.txt file
- If all fixed drives are scanned, all the worm files, autorun.inf from mapped drives and infected IRC scripts are deleted