W95.Spaces - Removal

To remove this virus:

1. If you have a current Rescue disk set that you created prior to the infection, skip to the next step. Otherwise, on another, uninfected computer on which NAV is installed, run LiveUpdate and create a Rescue disk set. For instructions on how to do this, see the document How to create or update a Norton AntiVirus rescue disk set when Norton AntiVirus is already installed.
2. Insert Rescue disk 1 into the floppy disk drive of the infected computer, and restart the computer.
3. Follow the prompts to run a virus scan.
4. Remove the Rescue disk, and then restart the computer.

Norton AntiVirus will not remove the 0x2020 ID from the Reserved1 field of the PE header. As a benefit, this acts as inoculation from the virus since the W95.Spaces virus will assume the file is already infected.

Technical Details