http://www.microsoft.com/security/an...om.asp#protect


If you use Windows XP, Windows 2000, or Windows NT 4.0 Visit the site above

================================================== ======

If you use Windows Millennium Edition, Windows 98, or Windows 95

To find out if a computer is infected, do the following:

Click Start, and then click Run.
In the Open box, type:
command
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\
followed by a cursor.
To check for Mydoom.A, click the cursor, and then type:
dir shimgapi.dll /a /s
Press ENTER.
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.A.
If Total Files Listed is displayed (see Figure 3 for details), the computer
is infected with Mydoom.A, and you need to Contact your antivirus vendor.
To check for Mydoom.B, click the cursor and then type:
dir ctfmon.dll /a /s
Wait a few moments:
If File Not Found is displayed, the computer is not infected with Mydoom.B.
If Total Files Listed is displayed (see Figure 4 for details), the computer
is infected with Mydoom.B, and you need to follow the steps below.


Top of page



What to Do If Your Computer Is Infected with Mydoom.B

If your computer is infected, first consult your preferred antivirus vendor
to get the latest updates and information. If you are unable to access your
antivirus vendor's website, you can regain access by using one of the
following procedures.

For Windows XP, Windows 2000, and Windows NT 4.0


Click Start, and then click Run.
In the Open box, type:
cmd.
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\
followed by a cursor.
Click the cursor and:
Type:
del /F %systemroot%\system32\drivers\etc\hosts
Press ENTER.
Type:
echo # Temporary HOSTS file >%systemroot%\system32\drivers\etc\hosts
Press ENTER.
Type:
attrib +R %systemroot%\system32\drivers\etc\hosts
Press ENTER.
After typing these commands, do one of the following:
If you use Windows NT 4.0, restart your computer.
If you use Windows XP or Windows 2000, do not restart your computer.
Instead, do the following:
Type:
ipconfig /flushdns
Press ENTER.

For Windows Millennium Edition, Windows 98, and Windows 95


Click Start, and then click Run.
In the Open box, type:
command.
Click OK. The black Command Prompt window will open, displaying C:\...>.
Type cd \ and press ENTER. This will change the current directory to C:\
followed by a cursor.
Click the cursor and:
Type:
del c:\windows\hosts
Press ENTER.



Top of page

Symantec
Computer Associates