Removal Instructions for I-Worm.Aliz

21 Nov 2001
Virus News

Removing I-Worm.Aliz from a PC

1. If MS Outlook Express or Internet Explorer are in operation, close these application windows.
2. Download the special patch from Microsoft Corporation: http://www.microsoft.com/windows/ie/downloads/critical/q290108/default.aspInstall the patch in your PC.
3. Disable the anti-virus Monitor to gain access to mail databases.

For Kaspersky Anti-Virus Monitor version 3.5

1) Click twice on the AVP Control Center icon in the system tray (the icon with the yellow wrench);
2) Open the "Tasks" tab;
3) Highlight "Load Monitor" task;
4) Click on it with the right mouse button and select "Properties," or just click twice on the "Load Monitor" task;
5) Open the "Actions" tab;
6) Unmark the "Enable" box

To apply changes in Monitor Options, press "Apply" in the AVP Control Center window button, and restart AVP Monitor (press the right button on the "Load Monitor" task and select "Restart"). The mark on AVP Monitor icon should change from red to black.

For Kaspersky Anti-Virus Monitor version 3.6

1) Click twice the Kaspersky Antivirus Control Center icon in the system tray;
2) Open the "Tasks" tab;
3) Highlight the "Start Kaspersky Anti-Virus Monitor" task;
4) Click this using the right mouse button and select "Stop"

4. Run the Kaspersky Anti-Virus Scanner (for full scanning use Scanner v. 3.5 or earlier); or for Scan MS Outlook Express databases use Scanner v. 3.6.;
5. Look at the Scanner report (its named report.txt or avp32.rpt depending on the Scanner version), and find the full information provided about infected messages (subject, date of receiving etc.);
6. Run Outlook Express;
7. Deactivate the preview pane function: Outlook Express: View>Layout> unmark Show preview pane;
8. Delete all infected messages manually;
9. Clean "Deleted Items" folder;
10. Compact folders: File->Folder->Compact all folders;
11. Enable the Anti-Virus Monitor;
12. Launch Kaspersky AV Scanner and make the full scanning;
13. If this virus is detected again on your PC, please contact the Kaspersky Lab Support Team for further instructions.