'I Think I Have a Virus…What Do I Do?'

Learn the basics for cleaning up your system and making sure it stays secure

If your PC begins crashing frequently, restarting spontaneously, or otherwise acting strangely, it's likely that your machine is either afflicted with spyware or infected with a virus. If the Computing Center detects a virus on your computer, you'll be notified via email and your network connection may be disabled until the virus is eradicated.

If you suspect you have a virus, or if you've been notified that you have one, what can you do? Below are some basic steps you can take to find and eradicate a virus.

How to detect a virus

• Install Norton AntiVirus (NAV) if it's not already installed.
  
• If you're using a Windows PC, insert the Windows Security CD. When the program starts, read the information displayed in each window. If you're unsure which option to select, press the ENTER key to choose the default option. (The Windows Security CD will enable a firewall if available, enable automatic Windows Updates, install specific critical patches, update virus definitions, and start a NAV scan. The Security CD can also help clean up spyware problems, should you have them. )
  
• Scan with NAV (if you're a Windows user, the Windows Security CD will do this for you, as described in the preceding paragraph). NAV should find the virus(es) and remove them. There is no need to watch the scan, but pay careful attention to the scan results.
  
• Scan again until the report comes up clean. If NAV gets "stuck" and keeps finding the same virus, see "What if NAV finds one or more viruses…?" below.

What if NAV finds nothing?

If your network connection has been disabled because we detected a virus on your computer, then NAV should find something. An antivirus scan that finds nothing usually means that your virus definitions file is not up-to-date (see "Live Update Expired?" at the bottom of this page).

What if NAV finds one or more viruses but doesn't fix the problem?

If your antivirus program identifies an infected file but does not quarantine, delete, or fix it, reboot your system in Safe Mode and do a full system scan for viruses. To enter Safe Mode in Windows, restart your computer while holding the F8 key. If necessary, contact Microcomputer Services for advice.

What if I can't get the virus definitions date to change?

This is a common problem. The usual cause is that your LiveUpdate subscription has expired. We can give you a renewal subscription code free of charge (see "LiveUpdate Expired?" below).

What if I can't get the NAV window to appear at all?

This is also a common problem. Some viruses block NAV from installing or running. Contact Microcomputer Services for advice.

Note: If you feel you are incapable of removing the virus yourself, please turn your computer off until technical support can assist you. We strongly recommend not using a machine that is virally infected. The longer a virus is on the system, the more damage it can do to your files. Extremely malicious viruses that delete or modify files on compromised systems not only cause problems for you, but due to their potential access to network shares they can also modify, delete, and infect files belonging to others.

Contact information:

Microcomputer Services is located on the ground floor of McKenzie Hall in Room 151 and is open weekdays from 9 a.m. to 5 p.m. You can reach their office by phone (541-346-4412) or email (microhelp@uoregon.edu). For general microcomputing advice as well as valuable troubleshooting and security tips, visit their website at http://micro.uoregon.edu/

Has Your Norton AntiVirus LiveUpdate Subscription Expired? [back to top]

If you’re getting messages that your UO Norton AntiVirus subscription has expired, don’t worry. You can renew your subscription easily. Here’s how:

Connect to UOnet (the campus network) and go to http://micro.uoregon.edu/av/ Click on the link “Virus Definition subscription codes for Live Update.” This link takes you to a page where you can find the appropriate code for your system. (Note that this link can be accessed only from a UO connection.) Instructions for entering the code are available under “Norton Antivirus” on our antivirus information page at http://micro.uoregon.edu/av/