S O B E R . S   D I S I N F E C T I O N
---------------------------------------

This is a very simple batch script utility to disable Sober.S 
worm in memory and to remove its files from a hard drive. The 
utility places special files on a hard disk that deactivate Sober 
worm. Then the utility deletes Sober's files from a hard drive 
and removes the Registry key values added by the worm.

Disinfection procedure should be as follows:

1. Unpack the utility from the provided ZIP archive either with 
WinZip or PkUnzip utilities. A trial version of WinZip archiver 
can be downloaded from the following website:

http://www.winzip.com/ddchomea.htm
                                   
2. Close all running applications and run the unpacked 
'sober_s_disinfect.bat' file from a hard disk. You can run the 
utility by either doubleclicking on it from Windows Explorer or 
you can start it from a command interpreter (COMMAND.COM or 
CMD.EXE) by typing its name at command prompt and pressing 
'Enter' (for advanced users).

The utility will place special files on a hard disk that will 
deactivate Sober.S worm on next reboot.

3. Restart a computer.

4. Run the 'sober_s_disinfect.bat' utility again to delete the 
worm's executable and data files and Registry key values created 
by the worm.


IMPORTANT NOTES
---------------

If a computer with Windows NT, 2000 or XP system is being 
disinfected, please log in as Administrator or as a user with 
local admin rights, otherwise the utility might not disinfect the 
system correctly.

If you have Windows ME or XP, it is recommended to disable System 
Restore feature of these operating systems to prevent your 
computer from re-infection with Sober worm. The fact is that 
System Restore feature of these operating systems might save the 
infected file into the special folder and copy it back to a hard 
drive it every time it's been deleted by the utility. The 
instructions on how to disable System Restore feature are here:

Windows ME:
http://www.europe.f-secure.com/v-descs/sfc_dis.shtml

Windows XP:
http://www.europe.f-secure.com/v-descs/sfc_dis1.shtml

If you have any problems using this utility please contact us on 
'anti-virus-support@f-secure.com' address.

Copyright (C) 2005 F-Secure Corporation. All rights reserved.