Yarner

To disinfect the worm it is enough to delete all its files from a hard drive and to delete all infected messages from email client's incoming email database. As some of worm's files have random names, they can be only found with F-Secure Anti-Virus and the latest updates.

You can download a trial version of F-Secure Anti-Virus with the latest updates from our website:

Http://www.europe.f-secure.com/download-purchase/

Install FSAV, apply the latest updates and scan your Windows directory for infection. When the worm's file is found, select 'Delete' disinfection action. Warning! If an infection is found in an email database, not in an EXE file, do NOT delete it as you will loose all your emails.

If a worm's file is locked and can't be deleted instantly, you will have to delete it from pure DOS (for Windows 9x systems) or rename it with a different extension (.EXA for example) with immediate system restart (for NT-based systems).

If an infection is found in your Windows ME or XP System Restore folder (usually '_Restore' directory), you will have to disable System Restore functionality of your Windows to avoid re-infection.

Finally rename NOTEDPAD.EXE back to NOTEPAD.EXE in Windows directory.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

• Check for the latest database updatesFirst, check if your F-Secure security program is using the latest updates, then try scanning the file again.
• Submit a sampleAfter checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
• Exclude a file from further scanningIf you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.Note: You need administrative rights to change the settings.