W32.Witty.Worm - Removal

---

Note: Because the worm resides in memory only and is not written to disk, virus definitions do not detect this threat. Symantec Security Response recommends that you follow the steps described below to remove this threat.

---

1. Obtain the patch for the vulnerability from http://www.iss.net/download/.
   
   
2. Disconnect the affected computer from the network.
   
   
3. Restart the computer to remove the threat from memory.
   
   

   ---

   Note: If the computer has been infected, it may not restart properly. If this occurs, Symantec Security Response recommends using a data recovery program.

   ---

   
   
4. Apply the patch.
   
   
5. Reconnect to the network.

Technical Details