Cleaning Up After a Computer Malware Attack

If you think you have a computer virus and you are running Symantec Endpoint Protection, do the following:

click 'Start' button then 'Programs' then 'Symantec Endpoint Protection' option then 'Symantec Endpoint Protection' program:
1. select the 'Scan Computer' on the left - see list of disks appear on right.
2. select the hard disk(s) - see ticks appear in the boxes.
3. click on the 'Scan' button - see disk be scanned for viruses.
4. follow instructions - for more info on running Symantec Endpoint Protection see Running Symantec Endpoint Protection.
if asked if you want to repair any viruses, answer 'Yes'.

Symantec Endpoint Protection will fail to clean-up many of the current viruses. To clean these 'hard to disinfect' viruses you will need one of the (free) special tools that Symantec make available.

use Symantec Endpoint Protection to identify the virus.
If you have already run Symantec Endpoint Protection:
1. click on the 'Histories' menu the 'Virus Histories' option and note down the virus name - you may well have to scroll right.
2. If necessary use an online anti-virus program to identify the virus.
go to Symantec's 'threat response' website.
locate the appropriate removal tool web page and print it.
download the 'removal tool' to your desktop.
if recommended - download the appropriate patch for Windows.
disconnect yourself from the network by unplugging your network connection.
if you have Windows XP - follow instructions to disable the 'System Restore' facility.
run the 'removal tool' - it will check all the files on your hard disk and remove all traces of the virus.
if recommended - install the Windows patch.
reconnect to the network
ensure your copy of Symantec Endpoint Protection program is up-to-date with the latest anti-virus definitions.
run a full disk scan of your hard disk using Symantec Endpoint Protection.

If you have a problem with the above instructions or there is no 'special tool' available for the virus that has infected your PC - call the ISS Service Desk on x10987.

[ Top ]

If Symantec Endpoint Protection Does Not Work

Many viruses attack Symantec Endpoint Protection and sometimes you can not use it to even detect a virus.

Online Virus Scanners - if the affected PC can go 'online' you can use online virus checkers to check and in some cases repair a virus.

After a Virus Attack & Clean-up

Changing Your Password

A number of viruses install keylogging programs designed to steal your passwords. After you have cleaned a virus off your PC it is a good idea to change your password. Choosing a secure password is important, to help you select a secure password follow: Choosing a secure password.