Mydoom Disinfection Procedure for Windows(r) RELEASE NOTES Notes on the Command Software Mydoom Emergency Repair Package for Windows 28 January 2004 The following contains instructions for disinfecting the W32/Mydoom.A@mm or W32/Mydoom.B@mm viruses. Before you begin, you MUST have: - Downloaded the latest definition files dated 01/28/2004 or later - Downloaded the Mydoom Emergency Rescue Package (MYDMTOOL.EXE) DISINFECTION The Mydoom Emergency Repair Package contains the following file: MYDMTOOL.EXE -- a self-extracting executable that contains the following files: - MYDMREM.EXE - the MYDMTOOL graphical user interface (GUI) - ENGLISH.TX1 - the updated messages - MACRO.DEF - the updated virus definition files - SIGN.DEF - the updated virus definition files - SIGN2.DEF - the updated virus definition files - CSSCAN32.DLL - the updated core scan engine file - CSS3RDE.DLL - the updated scan engine API - REPAIR.TXT - contains the disinfection instructions for Windows 2000/XP and Windows 95/98/Me To disinfect the virus, follow these steps: 1. Create a temporary folder called C:\Mydmtool 2. Copy the downloaded Mydoom Emergency Repair Package to this temporary folder. 3. Disconnect your machine from the network. 4. Go to the C:\Mydmtool folder that you created in Step 1. 5. Double-click the file to extract the files that are contained within it. 6. On the Windows taskbar, click START, and then RUN. 7. In the RUN/OPEN text box, type: C:\Mydmtool\MYDMREM 8. Click OK. The system displays the MYDMTOOL GUI. Please wait while the program loads the scan engine and performs a series of checks. 9. To begin a scan, click the START button. NOTE: This program scans ONLY for Mydoom. It does NOT scan for any other viruses. 10. When the scan is complete, exit the MYDMTOOL GUI. NOTE: If you are using Windows 95/98/Me, when the scan is complete, you are prompted to restart your computer. Reconnect your machine to the network, and click OK to restart. 11. Reconnect your machine to the network, and perform another full scan of any/all mapped drives using the CSAV GUI. NOTE: If you are using Windows NT, we highly recommend that after you reconnect your machine to the network, you restart your computer. 12. Update your virus definition files. WARNING: They must be dated 01/28/2004 or later.