Introduction

1. Disconnect and isolate. Think of it as putting the infected computer into quarantine. If you suspect that a computer has been attacked by a virus, physically disconnect the machine. An infected machine can endanger other computers.
   
   
2. Clean up. Once the computer has been disconnected, you need to remove the malicious code. Use removal tools written for the specific virus. Your antivirus software should have updates or patches available for the specific security threat. If this software hasn't been updated recently, be sure to do so. Symantec Security Response makes both removal tools and updated definitions available as soon as a threat is discovered. General information, new alerts, and step-by-step guides are available on the Symantec Security Response site.
   
   
3. Restore. After a virus attack, damages may range from changed file names to obliterated files to permanently disabled software applications. Before resuming work, you need to restore your computer to its original condition.
   
   
4. Reinstall. The extent of damage depends on the particular virus. If your operating system is completely destroyed, you'll need to reinstall. Use the 'quick restore' CD that came with your computer to restore your computer to its original configuration. This means that you will lose any applications you may have installed or data files you may have saved. Before you begin the reinstallation process, make sure you have all the necessary information handy - original software, licenses, registration, and serial numbers.
   
   
5. Scan for viruses. After restoring and reinstalling, scan your entire network, including all files and documents, for viruses. Use the most recent virus definitions available for your antivirus software.
   
   
6. Restore your data. This assumes that you have been diligent about backing up your files. If you don't follow a regular schedule of backups, your files will be permanently lost. If this is the case, learn from your mistake and make sure to back up regularly from now on. Keep in mind, not all viruses target data files – some attack only applications.
   
   
7. Prevent future attacks. Run antivirus software and keep virus definitions current. Ensure security patches are up-to-date. If you haven't been running antivirus software, start now!If you lost data files in the recent attack, you will want to create and enforce a regular backup schedule. Next, you will want to change all passwords, including ISP access passwords, FTP, email, and Web site passwords. Some viruses can capture or crack passwords, leading to future vulnerabilities. Change passwords immediately.