Please enable javascript to view this page in its intended format.

Queen's University
  • Removal Instructions

Help and Support

Virus - Greeting Card Removal Instructions


For more details on the Greeting Card Virus go to the Virus - Greeting Card web page. 

If you received the email containing the Greeting Card virus but you did not open the message or click on the attachment Congratulations!  Delete the email and the attachment and you are done.

If you received the email containing the Greeting Card virus and opened the attachment please continue with these removal instructions.

Step One 

As an initial step in disabling the "Greeting Card Virus," we are recommending that you restore your computer to a point in time not more than 7 days before you activated the infected e-mail. Please be aware that this procedure should disable the virus, but not necessarily remove it. You should still have your system checked to make sure the virus is, in fact, disabled.  At this time the only way to guarantee removal is to REIMAGE your computer.   This procedure has currently only been tested and confirmed in the Windows XP operating system.

Follow these steps to run System Restore:

  • 1) Click on Start -> All Programs -> Accessories -> System Tools -> System Restore.
  • 2) Make sure "Restore my computer to an earlier time" is selected and click Next.
  • 3) On the calendar, choose a date before you received the infected e-mail. We recommend not restoring from any point greater than 7 days in the past.

    *NOTE* - If there are no restore points to restore to then this procedure will not work for you. If this is the case, please leave your computer disconnected from the network and watch the ITServices web site for updates on having the virus removed from your computer.

  • 4) Once you have selected a restore date, choose a checkpoint from the right-hand section which shows details for that day. Choose the earliest restore point for that day, then click Next.
  • 5) On the next screen, confirm that the restore point you chose falls under the criteria discussed in the previous steps, and click Next.
  • 6) Windows will close all programs and begin restoring your computer.
  • 7) Once the restore process is finished, the computer will boot back into Windows.
  • 8) Login and you will be presented with a window explaining whether the restore was successful or not.

    *NOTE* If the restore was not successful, please leave your computer disconnected from the network and watch the ITServices web site for updates on having the virus removed from your computer.

  • 9) If the restore was successful, click OK and your desktop will load like normal.

Please note: This procedure will create a restore point on your computer that contains the virus. This is by design so that you have the option to "undo" the restore. We strongly recommend that you never restore back to this point as it does contain the virus and you will once again be infected.

Removable Storage Devices (e.g USB memory keys, external hard drives...)

If you believe you are infected with the "Greeting Card Virus" DO NOTattempt to backup any files to removable devices.  This virus has the ability to infect removable devices such as USB keys and external hard drives. As soon as you plug in one of these devices, the virus will copy itself onto the device. Any computers that you plug this device into will also get infected with the virus. We are currently working on this issue.


Kingston, Ontario, Canada K7L 3N6 613.533.2000