W32/Gibe-F disinfection instructions
Resolve is the name for a set of small, downloadable Sophos utilities designed to remove and undo the changes made by certain viruses, Trojans and worms. They terminate any virus processes and reset any registry keys that the virus changed. Existing infections can be cleaned up quickly and easily, both on individual workstations and over networks with large numbers of computers.
W32/Gibe-F can be removed from Windows 95/98/Me and Windows NT/2000/XP/2003 computers automatically with the following Resolve tools.
Note: When disinfecting variants not listed above, use the recovery instructions in the appropriate virus analysis.
Windows disinfector
GIBFGUI is a disinfector for standalone Windows computers
- open GIBFGUI
- run it
- then click GO.
If you are disinfecting several computers, download it, save it to floppy disk and run it from there.
After removing the worm you should install the Microsoft patch MS01-027 or on single computers update with all relevant security patches from Windows update.
Command line disinfector
GIBFSFX.EXE is a self-extracting archive containing GIBFCLI, a Resolve command line disinfector for use on Windows networks. Read the notes enclosed in the self-extractor for details on running this program.
After removing the worm you should install the Microsoft patch MS01-027 or on single computers update with all relevant security patches from Windows update.
Other platforms
To remove W32/Gibe-F on other platforms please follow the instructions for removing worms.
Hints on running the W32/Gibe-F tool
Most of the time the W32/Gibe-F tool will run with no problems. If you do encounter problems, try the following:
- Windows NT/2000/XP/2003
Save or rename the GIBFGUI.COM file to GIBFGUI.CMD, then run it. - Windows 95/98/Me
- Download and extract GIBFSFX.EXE then run GIBFCLI.COM from a command prompt.
- Reset the registry then run GIBFGUI.COM in Safe mode.
