1. REBOOT INTO SAFE MODE WITH NETWORKING
• Reboot your computer, holding down the F8 key as it is starting up. This should bring you to a menu of options. Use the arrow keys to navigate to Safe Mode with Networking. Press Enter.
  
  
2. SEARCH HARD DRIVE FOR VIRUS FILES
• In Windows NT/2000, go to Start, Search, Find Files or Folders.
• In Windows XP, go to Start, Search. Choose All files and folders from the list of options on the left side of the screen.
• Search for the following files:
  • scvhost.exe
  • sysldr32.exe
  • svchos1.exe
  • winhl32.exe
  • winhlpp32.exe
• If any of the above files are found, delete them.
  
  
3. REMOVE REGISTRY KEYS
• Go to Start, Run, and type regedit.
• Press CTRL-F to "find". Type scvhost and press Enter. If a registry key is found that contains scvhost, delete it. Then, press F3 to "find next". Continue to "find next" until you get a message that says Finished searching the registry.
  
  
4. RUN WINDOWS UPDATE
• Open Internet Explorer and go to http://windowsupdate.microsoft.com/
• If asked to install the latest Windows Update software, select Yes.
• Click on Scan for updates.
• After scan is completed, click on Review and install updates.
• There are three categories of updates available from the Windows Update site:
  1. Critical Updates and Service Packs
  2. Windows 2000 or XP Updates
  3. Driver Updates
• You should install all Critical Updates and Service Packs. However, it is not necessary to install Windows 2000/XP Updates or Driver Updates.
• Once you have selected the updates you wish to install, click Install Now. Depending on how many updates you are installing, the process may take 5 - 25 minutes. When updates are finished installing, you will be asked to reboot your computer.
  
  
5. UPDATE VIRUS DEFINITIONS
• If you have Norton AntiVirus or Symantec AntiVirus, open your anti-virus software and click on the LiveUpdate button to obtain new virus definitions. Definitions dated 10/29/03 rev.7 and later will contain the necessary files for detecting the Gaobot virus.
  
  
6. SCAN HARD DRIVE
   • Once your virus definitions are up to date, use your anti-virus software to run a full hard drive scan. If any files are quarantined, delete them.

If you have any questions or problems, please call the WITS Help Desk at x6767, or stop by Smullin 119 to visit us in person.

Last Update: 11/07/2003