The following instructions pertain to all current and recent Symantec
antivirus products, including the Symantec AntiVirus and Norton
AntiVirus product lines.
- Disable System Restore (Windows Me/XP).
- Update the virus definitions.
- Run a full system scan.
- Delete any values added to the registry.
For specific details on each of these steps, read the following instructions. 1. To disable System Restore (Windows Me/XP)
If you are running Windows Me or Windows XP, we recommend that you
temporarily turn off System Restore. Windows Me/XP uses this feature,
which is enabled by default, to restore the files on your computer in
case they become damaged. If a virus, worm, or Trojan infects a
computer, System Restore may back up the virus, worm, or Trojan on the
Windows prevents outside programs, including
antivirus programs, from modifying System Restore. Therefore, antivirus
programs or tools cannot remove threats in the System Restore folder.
As a result, System Restore has the potential of restoring an infected
file on your computer, even after you have cleaned the infected files
from all the other locations.
Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.
For instructions on how to turn off System Restore, read your Windows documentation, or one of the following articles:
When you are completely finished with the removal procedure and are
satisfied that the threat has been removed, reenable System Restore by
following the instructions in the aforementioned documents.
additional information, and an alternative to disabling Windows Me
System Restore, see the Microsoft Knowledge Base article: Antivirus Tools Cannot Clean Infected Files in the _Restore Folder
(Article ID: Q263455). 2. To update the virus definitions
Symantec Security Response fully tests all the virus definitions for
quality assurance before they are posted to our servers. There are two
ways to obtain the most recent virus definitions:
- Running LiveUpdate, which is the easiest way to obtain virus definitions.
you use Norton AntiVirus 2006, Symantec AntiVirus Corporate Edition
10.0, or newer products, LiveUpdate definitions are updated daily.
These products include newer technology.
If you use Norton
AntiVirus 2005, Symantec AntiVirus Corporate Edition 9.0, or earlier
products, LiveUpdate definitions are updated weekly. The exception is
major outbreaks, when definitions are updated more often.
the definitions using the Intelligent Updater: The Intelligent Updater
virus definitions are posted daily. You should download the definitions
from the Symantec Security Response Web site and manually install them.
The latest Intelligent Updater virus definitions can be obtained here: Intelligent Updater virus definitions
. For detailed instructions read the document: How to update virus definition files using the Intelligent Updater
. 3. To run a full system scan
- Start your Symantec antivirus program and make sure that it is configured to scan all the files.
For Norton AntiVirus consumer products: Read the document: How to configure Norton AntiVirus to scan all files.
For Symantec AntiVirus Enterprise products: Read the document: How to verify that a Symantec Corporate antivirus product is set to scan all files.
- Run a full system scan.
- If any files are detected, follow the instructions displayed by your antivirus program.
- Delete the autorun.inf file from writeable removable devices, if necessary.
If you are unable to start your Symantec antivirus product or the
product reports that it cannot delete a detected file, you may need to
stop the risk from running in order to remove it. To do this, run the
scan in Safe mode. For instructions, read the document, How to start the computer in Safe Mode
. Once you have restarted in Safe mode, run the scan again.
After the files are deleted, restart the computer in Normal mode and proceed with the next section.
messages may be displayed when the computer is restarted, since the
threat may not be fully removed at this point. You can ignore these
messages and click OK. These messages will not appear when the computer
is restarted after the removal instructions have been fully completed.
The messages displayed may be similar to the following: Title:
[FILE PATH] Message body:
Windows cannot find [FILE NAME]. Make sure you typed the name
correctly, and then try again. To search for a file, click the Start
button, and then click Search. 4. To delete the value from the registry Important:
Symantec strongly recommends that you back up the registry before
making any changes to it. Incorrect changes to the registry can result
in permanent data loss or corrupted files. Modify the specified subkeys
only. For instructions refer to the document: How to make a backup of the Windows registry
- Click Start > Run.
- Type regedit
- Click OK.
If the registry editor fails to open the threat may have modified the
registry to prevent access to the registry editor. Security Response
has developed a tool to resolve this problem. Download and run this tool, and then continue with the removal.
- Navigate to the following registry subkeys:
- In the right pane, delete any values associated with the worm.
- Exit the Registry Editor.