jeśli nie jest za późno... Disinfecting PE executables in Windows NT/2000/XP On a lightly infected computer running Windows NT/2000/XP, where no significant services have become infected, it may be possible to run SAV32CLI from a command prompt with the -DI switch. First, check the recovery instructions in the virus analysis for any extra measures you should take before (and after) disinfecting. Also, check to see if you need an IDE file. If you do, download it and save it to a floppy disk. There is a copy of SAV32CLI in the WIN32\I386\SAV32CLI folder on the Sophos CD. If you do not need any extra IDE files you can run SAV32CLI directly from here. If you need extra IDE files, do as follows. On an uninfected computer, copy this folder onto a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session). Alternatively, download an emergency copy of SAV32CLI. On an uninfected Windows computer, run this file to extract the contents into a SAV32CLI folder on a medium that can be write-protected. Add any relevant IDEs to this folder and write-protect the disk (on a CD/R or CD/RW close the session). Now close down all possible programs and services, then open a command prompt. | 
