to do when you suspect a virus
not panic. Virtually any virus can be removed without
reformatting a hard drive or diskette.
the latest version of at least two of the better
anti-virus products which detect/remove viruses.
the following products seem to be amongst the better
Scanner/Remover products - which can be used after
the infection has occurred:
an uninfected computer, UNZIP each package onto a diskette and
write protect the diskette. A system formatted diskette is best
but is not necessary if the original DOS or OS/2 diskettes
the computer suspected of being infected off. Put the
boot diskette into drive A. Turn on the computer. This is known
as a cold boot and is required for certainty in removing
the computer has booted up, replace the DOS or OS/2 boot disk
with the Anti-Virus product disk, unless the A-V product diskette
is also a boot disk. Then run the A-V product from Drive A as
per its instructions.
F-PROT the command line recommended is:
F-PROT /HARD /ALL /DISINF /REPORT=C:FPROT.RPT
will be used for the remainder of the example, but only as
an example. Each of the other products uses its own command
structure but can be used the same way.
F-PROT reports drive C is missing, a virus such as Monkey, which
hides or encrypts the partition table, is probable. Repeat without
the /REPORT command on the command line. Do not run FDISK/MBR
if this happens.
a virus is reported, you will either be given a choice of stripping
it out of the programs that were infected or of deleting the
infected program (if an overwriting virus) or will be told it
is a suspected virus in which case you will have to decide since
the A-V product will not delete or remove the virus unless there
is exact identification.
according to your requirements. If a virus is exactly identified
it can be stripped out, or the infected program deleted. Else
you must decide if you want to delete the suspect file(s). You
should have the original application diskettes on hand so that
you can replace the damaged programs. That is always the best
course of action. If you do not, then attempt to strip out the
the virus infected programs are removed/replaced, repeat steps
4-7 to be sure the computer is clean of viruses. Then check
every diskette that has been near the computer - at least one
is probably infected. This is always true if the virus is a
boot sector virus - virus droppers for them are rare.
the A-V product's TSR program as early in CONFIG.SYS or AUTOEXEC.
BAT as possible. Read the documentation for the TSR to determine
the requirements. For F-PROT, the TSR is VIRSTOP and the best
command choice is a device driver in CONFIG.SYS, similar to
/WARM /BOOT /COPY
are other A-V products that function very well if installed
before there is a virus infection and are used according
to their instructions.
the products named are updated regularly,
and the current version must be used in all cases.
In the worst cases the updates are quarterly. Most products
update every month or every two months, just to keep up. There
are at least 100 new viruses each month, these days.
every diskette and every download
from a BBS or friend, or from the net, and especially from irc
and ICQ, before you run it on your computer, with the
latest version of two anti-virus products such as those named
and you are likely to avoid all but the newest viruses. These
new viruses can still get you, but the next version of the A-V
product will likely find them, if they are in the 'wild'....
you find a virus that is not identified with certainty, save
a copy and send it to the Anti-Virus product producer of the
product you used, so that it can be added to his/her product.
Instructions for how to do this will be included with all of
the better A-V products.
turn on your computer with a diskette in drive A, unless you
are certain that the diskette does not have a boot sector virus.
luck, and I hope you never need to use these instructions.
by Tim O'Leary Jan 1999, from information written by: R.S. (Bob)
Heuman Willowdale, Ontario, Canada. Permission given by hhikers
Internet Services (Webmaster)
Download Links : Getting
rid of virus : e-Newsletter
Virus FAQ :
CIH Fix : Happy99
: Trojans & Malware : ZIP
drive Click-o-Death :