Article URL: http://www.bc.edu/helpdocs/RX-virusdetected001.shtml

Summary:  If you have been directed to this Web page because a virus was detected on your Windows XP computer, you must complete the following steps to clean your computer and protect it from future virus assaults. Failure to do so will result in loss of access to the BC Network.

Contents:

• Part 1: Turn off system restore
• Part 2: Update virus definitions (DAT) file
• Part 3: Delete temporary Internet files & cookies
• Part 4: Start your computer in Safe mode
• Part 5: Scan your computer and remove viruses
• Part 6: Turn system restore back on

Part 1: Turn off system restore

If your computer running Windows XP is infected with a virus, it is possible for the virus to be backed up by the System Restore function. You could then restore a virus-infected file. Due to the proliferation of computer viruses and worms, it is recommended that you disable system restore on your computer.

To turn off system restore:

1. Click Start, right-click My Computer, then click Properties. (Classic view: On your Desktop, right-click the My Computer icon, then click Properties.)
2. Click the System Restore tab.
3. Select the Turn off System Restore or Turn off System Restore on all drives checkbox, then click Apply (see Figure 1).


Figure 1.

When you get a message warning you that all previous restore points will be deleted, click Yes (see Figure 2).


Figure 2.

5. Click OK.

Return to Contents

Part 2: Update virus definitions (DAT) file

McAfee VirusScan is pre-configured to automatically update your anti-virus protection every day (except Saturday) from both on-campus and off-campus. Complete the following steps to ensure that you have the most recent virus definition file available:

1. Restart your computer again (as you normally do).
2. In your system tray (bottom-right corner of your screen), right-click the VirusScan icon (), then click Update Now.
   - OR -
   Click Start, point to Programs, point to Network Associates, then click VirusScan Console. In the VirusScan Console window, right-click AutoUpdate, then click Start (see Figure 3).


Figure 3.

3. When AutoUpdate finishes installing the latest virus definition files on your computer, the windows says “Update Finished.” Click Close.

Return to Contents

Part 3: Delete temporary Internet files & cookies

To delete temporary Internet files & cookies:

1. Click Start, then click Control Panel. (Classic view: Click Start, point to Settings, and then click Control Panel.)
2. Double-click Internet Options.
3. Do the following (see Figure 4):
• Under the Temporary Internet files heading, click Delete Cookies.
• When prompted whether to delete all cookies, click OK.
• Under the Temporary Internet files heading, click Delete Files.


Figure 4.


4. When prompted whether to delete all files, check the Delete all offline content box, then click OK (see Figure 5).
   
   
   Figure 5.
   
   
5. On the Internet Properties window, click OK.

Return to Contents

Part 4: Start your computer in Safe mode

To start your computer in Safe mode:

1. Restart your computer.
2. While your computer is restarting, press <F8>.
   Important: You must press <F8> at the moment just before Windows begins to start. If you see a "keyboard error" message, restart the computer and try again.
3. Using the arrow keys on your keyboard, select Safe Mode and then press <Enter>.

Part 5: Scan your computer and remove viruses

Note: The initial scan of your computer may take a long time to complete.

To scan your computer for viruses and remove them:

1. Right-click on My Computer and from the drop-down list, click Scan for viruses.
2. If a virus, spyware, or adware is found, VirusScan attempts to delete it. Depending upon the results of this, one of the following happens:
   • The infected file gets deleted, so you do not need to do anything else. Your computer is no longer infected.
   • The infected file cannot be deleted, so the file is moved to the C:/Quarantine folder (see Figure 6). Delete the file from the Quarantine folder: Within the VirusScan window, right-click the file name and click Delete.
     
     Figure 6.
     
     
   • The infected file cannot be deleted and it cannot be moved to the C:/Quarantine folder (see Figure 7). To get rid of it, bring your computer to the walk-in Help Center in O'Neill 248 next to the Campus Technology Resource Center ( CTRC).
     
     Figure 7.
   
   Important: Some viruses can damage files so that they are unusable. In this instance, your file is already beyond repair. VirusScan cleans the file, but may not be able to save it. This is where back-ups come in handy. Learn more about the options for storing your documents and files at Boston College.
   
   Do not use periods when naming your files! Outlook moves messages with attachments that have 2 or more periods in the name (For example: notes.04.01.20.doc) to the Junk E-mail folder. To prevent this, do not use periods when naming your files, and also remind people that send you attachments not to use periods.
   
   
3. When scanning is done, close all McAfee VirusScan windows.

Note: It may take up to a week for McAfee to release virus definitions capable of detecting and removing new infections. If the virus you are infected with is not detected by VirusScan or the viruses (not spyware) cannot be removed or quarantined or moved, please call 617-552-HELP (4357), as we may have manual removal instructions available.

Return to Contents

Part 6: Turn system restore back on

To turn on system restore:

1. Click Start, right-click My Computer, then click Properties. (Classic view: On your Desktop, right-click the My Computer icon, then click Properties.)
2. Click the System Restore tab.
3. Do the following (see Figure 8):
   • Uncheck the Turn off System Restore or Turn off System Restore on all drives box.
   • Click Apply.
   • Click OK.
   
   Figure 8.

Return to Contents