
F - P A R I T E
---------------

The F-Parite utility disinfects computers infected with the 
following Parite virus variants:

Virus.Win32.Parite.a
Virus.Win32.Parite.b
Virus.Win32.Parite.c

Disinfection procedure should be as follows:

1. Set the default disinfection action of F-Secure Anti-Virus's 
real-time scanner (on-access scanner) to 'Disinfect 
Automatically'. This is important for prevention of re-infection 
of a cleaned computer from an infected network.

2. Unpack the F-Parite utility from the provided ZIP archive 
either with WinZip or PkUnzip utilities. A trial version of 
WinZip archiver can be downloaded from the following website:

http://www.winzip.com/ddchomea.htm
                                   
3. Close all running applications and run the unpacked 
F-Parite.com file from a hard disk to eliminate the infection. 
You can run the utility by either doubleclicking on it from 
Windows Explorer or you can start it from a command interpreter 
(COMMAND.COM or CMD.EXE) by typing its name at command prompt and 
pressing 'Enter' (for advanced users).

First the F-Parite utility will kill Parite virus's process in 
memory. Then the utility will remove Registry entries created by 
the virus. Finally the utility will scan all hard drives for 
infected files and disinfect them. The Parite's dropper files 
will be deleted.

4. Restart a computer. After restart your system should be clean.


You can get a trial version of F-Secure Anti-Virus and the latest 
updates for it from our website:

http://www.europe.f-secure.com/download-purchase/list.shtml
http://www.europe.f-secure.com/download-purchase/updates.shtml


IMPORTANT NOTES
---------------

Parite is a network-aware virus, so the utility disables network 
shares and deletes network drives mapped by users. This is done 
to prevent re-infection of a cleaned computer from a network. 
Network drives mapped by the logon script will be restored after 
computer is restarted.

Also do not forget to set the default disinfection action to 
'Disinfect Automatically' as described in pp.1 above.

During disinfection of Parite virus the utility will have to 
temporarily close Explorer.exe file (one of the main Windows 
components) that will result in disappearing of all icons on a 
desktop and a taskbar on the bottom of the screen. This is 
normal, the tool will restart Explorer.exe file after checking it 
for infection.

If a computer with Windows NT, 2000 or XP system is being 
disinfected, please log in as Administrator or as a user with 
local admin rights, otherwise the F-Parite utility might not 
disinfect the system correctly.

If you have Windows ME or XP, it is recommended to disable System 
Restore feature of these operating systems to prevent your 
computer from re-infection with Parite virus. The fact is that 
System Restore feature of these operating systems might save 
infected files into the special folder and copy them back to a 
hard drive after disinfection. The instructions on how to disable 
System Restore feature are here:

Windows ME:
http://www.europe.f-secure.com/v-descs/sfc_dis.shtml

Windows XP:
http://www.europe.f-secure.com/v-descs/sfc_dis1.shtml

If you have any problems using this utility please contact us on 
'anti-virus-support@f-secure.com' address.

Copyright (C) 2006 F-Secure Corporation. All rights reserved.
