Linux for the Real World

So you have a hacked or infected computer.

Disconnect it from your network... Now

Having disconnected it you need to update it's anti-virus software. So I am assuming that you already have Symantec Endpoint on it.

What you need to do now is make sure you have the latest definitions, these are the files that are updated almost daily to keep you safe. Obviously something did not keep you safe.

Getting the latest Definitions.

1. As of Feb 2010 this was the location to go get the definitions:
2. http://www.symantec.com/business/security_response/definitions/download/detail.jsp?gid=savce
3. So on a another computer go to this location
4. There is a section on this page called:
5. Client installations on Windows Platforms (32-bit)
6. Then a sub section called:
7. Symantec Endpoint Protection Client installations on Windows platforms (32-bit)
8. I find it best to click on the FTP link.
9. The file is something like: 20100217-056-v5i32.exe
10. Which is the date of the file and it's version.
11. This is about a 60 Meg file so may take a few minutes to download.

Installing the latest Definitions

1. Write File to a CD
2. You could use a USB key, but unless you can make it read only when you go to use it on the infected PC, you may infect the USB key. Not a good look.
3. On the infected PC, double click on the file you have just down loaded (20100217-056-v5i32.exe)
4. Done

Check this PC

Do a full scan on this PC to kill all problems