As part of their routine, many worms and Trojans make changes to the registry. Some of them change one or more of the shellopencommand keys. If these keys are changed, the worm or Trojan will run each time that you run certain files. _&73\xti  
vHY?n^ `  
For example, if the exefileshellopencommand key is changed, the threat will run each time that you run any .exe file. This may also stop you from running the Registry Editor to try to fix this. vp@> i  
G 7kgA.o^~  
They may also change a registry value so that you cannot run the Registry Editor at all. ` b)%)b'  
OQR<j^g  
Symantec Security Response has created a tool to reset these registry values to their default settings. H#C[)'w  
u{VIi;TZ.=  
WARNING: Do not use this tool unless: `q/2};U*  
| v_qRj  
A Symantec technician or document directs you to do so. NSA_kQ8@  
After reading the removal instructions in the writeup, you are sure that the tool is required. +Lo' ']  
Y=t`>s? /  
Follow these steps: K&K!CO%3$  
60!vv}  
Download the file UnHookExec.inf and save it to your Windows desktop. zDqM{V-  
}y}w)" ~  
(If you cannot connect to the Internet from the infected computer, download to an uninfected computer then save it to a floppy disk. Then take the floppy disk and insert it in the floppy disk drive of the infected computer.) C3"qi,  
1W,mt9 n  
Note: The tool has a .inf file extension. O#)r)!W`QC  
`S+l0^ o  
Locate the download file, either on the Windows desktop or the floppy disk. -ul4;1K[  
thx{~JDi  
$rl0.;Y-  
Right-click the UnHookExec.inf file and click install. (This is a small file. It does not display any notice or boxes when you run it.) (-u4a}WS  
Cz :I?  
PI#@I|A  
Follow any other instructions for the threat that you are trying to remove.

附件： UnHookExec.inf (1 K)