6

Possible Duplicate:
What to do if my computer is infected by a virus or a malware?

I'd like to know what tools and methods are used by the pros to remove malware in Windows. Is HijackThis enough? How do you manually identify the stuff that's deeply rooted into the OS?

My dad's XP system is clearly infected with something, but the usual advice (multiple scanning tools in safe mode, live CDs, etc) just ain't cutting it. He refuses to format because he has work that needs to be done, and for now the malware hasn't done anything too obstructive.

I'm embarrassed to say that I recently completed a Computer Science degree at a top 10 CS school.

Improve this question
3
  • See here - This is a pretty good guide that I wrote and others have been editing. superuser.com/questions/100360/…
    – William Hilsum
    Commented Jul 25, 2010 at 16:51
  • Haven't you heard the old quote (I think it was by Djikstra) that computer science isn't about computers? Now, if you'd just finished a system administrator course with a good certificate, you'd be right to be embarrassed. If any of your CS courses at university discussed practical methods for malware removal (except maybe a specialised security course), you went to the wrong kind of university.
    – rumtscho
    Commented Jul 25, 2010 at 18:17
  • 2
    "As explained in comment, this should remain a simple reference, and not a pretext to close any related question as duplicate of this one. Even if steps to follow are often the same, each situation is different. When referring to this question, suggest to the asker to update his question with more details about his situation: what worked, what didn't, what happened." Yet this question was closed as a duplicate......
    – James Watt
    Commented Jul 25, 2010 at 19:21

4 Answers 4

Reset to default
4

Here is the method I use. It is pretty successful and takes less than 90 minutes.

Build a flash drive

Download the following from an uninfected computer and load them onto a flash drive. Alternatively, you can burn these to a CD.

(I suggest extracting the EXE fix from the ZIP file and putting the registry file on your flash drive.)

Boot into "Safe Mode with Networking"

On the infected computer, boot into safe mode with networking. This is done by pressing the F8 key on the keyboard BEFORE the "Loading Windows" screen appears.

Insert the flash drive (or CD). If you are running on XP, launch the .exe file extension fix (even if you don't think you have a problem with .exe file extensions.)

Next, install Malwarebytes Anti-Malware. On Vista and Windows 7, make sure to right click on the installer and press, "Run as Administrator".

Updating Definitions

Now that you have Malwarebytes installed, you'll want to check your malware definitions. If you fail to do this step, you will not be removing the entire infection from your computer.

Go to the "updates" tab. Check the definition date. No matter what it says, you should do at least one update for good measure. After the first update, if the date is still older than just a couple days ago, you'll need to do a second update. Sometimes I have to do up to three updates to get Malwarebytes up to date.

Scanning for Malware

Go back to the main tab and choose "Full Scan". An average computer has about 100,000 objects and takes 20-30 minutes to scan. This takes longer if the computer has had multiple service packs on it over the years.

When it finishes, click "Show Results". Double check everything in here and then Remove All. It will show you a text log file (you can close this, it's already saved) and then the program will ask you to reboot your computer. Go ahead and let it reboot.

ComboFix

When your computer reboots, don't go into safe mode.

If you have an antivirus loaded onto your computer, you'll want to disable the active protection that it does for this next step. Many antiviruses, such as Symantec, can be disabled by simply right clicking on the icon in the system tray. Other programs, like AVG, require that you actually go into the program and disable them.

Once you have done that, launch ComboFix from your flash drive (Vista and 7 users will want to right click on ComboFix and press "Run as Administrator.")

Accept the warning notice. ComboFix will check for a new version automatically. If there is one, let it download it. It will tell you that it wants to install the Microsoft Recovery Console, permit it to do that as well. If it detects the presence of a RootKit (it is very good about finding these), it will reboot your computer into a safer environment automatically.

Finally, it will start to scan for infections. After a good 10-15 minutes, it will automatically start removing the infections. The program takes forever to finish and clean up (another 10 minutes) and may reboot a few times during the procedure, so be patient. A text log file will be displayed after the program has finished. Do not close the blue window, it will close on its own. Sometimes it takes up to 10 minutes to close.

Reset Internet Explorer

The last thing to do is open Internet Explorer and reset it to factory settings. This will remove any infected add-ons or dlls that are still lodged into IE. To do this, go to "Tools", "Internet Options", Click the "Advanced" Tab, and press the button toward the bottom that says "Reset".

I would suggest checking "Delete Personal Settings", but this usually works without doing that.

Reaction to Criticism

A lot of computer experts advise against cleaning up malware from a user's computer. They claims that you can never really get the infection off and that you can't trust that Malwarebytes and Combofix actually found all of the infection.

My best advice is that the people who fall for these scams often fall for them repeatedly (twice a year or so). Spending the time to reload Windows on their computer is a waste, because you'll be back out there again. More importantly, an IT professional is going to charge you for 3-4 hours for a Windows reload, where the procedure listed above can be done in 60-90 minutes.

Just be informative with the user about the dangerous of repairing vs. reloading and the cost difference of each. It also doesn't hurt to do occasional scans with an updated version of Malwarebytes or ComboFix over the next couple weeks to see if you missed anything the first time around.

Additional information: I remove malware and viruses from 3-5 computers per week. My removal process is always evolving to combat the constant new tricks of malware, but this particular method has been my plan of attack for the last four months. If I find in the future that it stops working or that there are changes needed, I will return to this page and make those changes.

Improve this answer
8
  • I totally agree with you on the last part, malware is just software and can always be detected with the right tools and removed with the right scanners. I'm not going to upvote you as I'm going to place a similar answer myself with a method that is more efficient than the one you stated, I just hate things that scan a lot...
    – Tamara Wijsman
    Commented Jul 25, 2010 at 18:30
  • 1
    Phrases like "for good measure" speak to voodoo troubleshooting and a lack of really understanding things. It also means putting a lot of faith in the tools. But phrases like "pretty good at finding rootkits" fail to build this confidence. Is it perfect? If it's not, you're in trouble. I believe your method will work 95% of the time, and that's pretty good. But that other 5% can get you in real trouble these days. It used to just mean a slightly slower PC, but now it might mean identity theft or a drained bank account. IMO that's just not worth it.
    – Joel Coehoorn
    Commented Jul 25, 2010 at 18:43
  • Also, when you do come across users who are repeat offenders, you set them up to put their data on a separate partition in the first place, so complete rebuilds don't have to be as big a deal. When I worked as a consultant, we might have had a machine on the bench all day, but a reinstall only billed out at most 1.5 to 2 hrs because most of that time doesn't require tech supervision - it's just windows loading itself or applying updates.
    – Joel Coehoorn
    Commented Jul 25, 2010 at 18:47
  • 1
    Just some examples: Adobe Creative Suite, Games, Microsoft Office, Microsoft Visual Studio; and that's not even 1% of what I need to do when I would reinstall my computer... :-(
    – Tamara Wijsman
    Commented Jul 25, 2010 at 18:59
  • 1
    More importantly, all too often computer experts snobbishly answer questions with some other unrelated answer (like how to format a computer) instead of answering the question asked (how to remove malware without formatting). If you don't agree with the goal of a question, don't reply! You're not helping, just arguing. I clearly stated at the bottom of my post that you should always inform the customer of the options (repairing vs reloading), but that ultimately it is up to the customer.
    – James Watt
    Commented Jul 25, 2010 at 19:03
5

Take off and nuke the site from orbit, it's the only way to be sure.

— Aliens

Seriously, flatten the machine. When re-installing, store all your data on an external drive (or two) and don't ever allow executables to be stored on there.

Windows has in effect become a 'disposable' installation and you shouldn't get used to it being around for long before it needs re-installing.

And to directly address your question, that is pretty much what all the 'pros' do now. It's just not worth the effort to poke around with DLLs any more.

As for the 'has work to do' argument, explain that it's like driving a car with a flat. In the long run it will always be quicker to stop and change it than to crawl slowly along because you 'dont have time to stop'.

Improve this answer
2
  • -1 You can perfectly disable all non-rootkit malware as described in my answer. Even for rootkits there is software to detect and remove them. Both these allow you to perfectly prevent malware to start. The last thing you can do is scan to remove any files that are left...
    – Tamara Wijsman
    Commented Jul 25, 2010 at 18:29
  • (OP here) I agree, but see my comment on joel-coehoorn 's answer
    – Jay
    Commented Jul 25, 2010 at 21:05
4

Real power users don't do this all. Really.

It used to be okay, but things have changed over the last several years:

  1. Modern malware travels in packs. You start out with just one breach, but once breached that first infection will download others.
  2. Modern malware is sneakier. Rootkits are becoming more sophisticated, common, and better at evading detection. Your efforts might remove one infection, but leave a buddy still hiding behind a rootkit.
  3. Modern malware is nastier. It used to just show you ads. Now it steals your credit card numbers, banking password, or identity.
  4. Modern malware goes deeper. Sometimes it simply can't be removed without breaking the infected system anyway.

Put all this together and what it means is that it's just not worth it to fix an infected computer. Instead, back up your data, wipe the hard drive, re-install the operating system and apps, and restore your data. Nuke it from orbit, it's the only way to be sure.

For me, it was item #3 that really tipped the scales to this conclusion. I used to be pretty good at removing bad stuff, to the point where I made a significant portion of my living that way, but we put more valuable information on our computers than we did even a few years ago. I particularly want to address this point:

for now the malware hasn't done anything too obstructive.

How do you know? Are you certain his personal details haven't been hijacked and used to create a green card and credit history for some illegal immigrant in Arizona? That might not show up for a few years, but when it does it can pretty much ruin your life.

Improve this answer
3
  • -1 You can perfectly disable all non-rootkit malware as described in my answer. Even for rootkits there is software to detect and remove them. Both these allow you to perfectly prevent malware to start. The last thing you can do is scan to remove any files that are left...
    – Tamara Wijsman
    Commented Jul 25, 2010 at 18:27
  • (OP here) I agree with you on this post, and I'm fully aware of what you're saying about malware being more destructive than it appears. However, I was hoping to fix his computer until he's gotten ahead in work, and then format the thing. That computer doesn't have info that's too sensitive on it, and I'll make sure no one logs into any web accounts on it.
    – Jay
    Commented Jul 25, 2010 at 21:02
  • +1, although fiddling with traps has never been ok unless you somehow get off on that.
    – XTL
    Commented Mar 7, 2012 at 13:02
1

My way of removing malware is effective and I have never seen it fail:

  1. Download Autoruns and if you still run 32-bit download a rootkit scanner.
  2. Boot into Safe Mode and start Autoruns if you are able to, then go to step 5.
  3. If you can't get into Safe Mode, connect the disk to another computer.
  4. Start Autoruns on that computer, go to File -> Analyze Offline System and fill it in.
  5. Wait for the scan to be done.
  6. In the Options menu, select everything.
  7. Let it scan again by pressing F5. This will go quick as things are cached.
  8. Go through the list and uncheck anything that is conspicious or does not have a verified company.
  9. Optional: Run the rootkit scanner.
  10. Let a top virus scanner remove any files that were left.
  11. Optional: Run anti-malware and anti-spyware scanners to get rid of junk.
  12. Optional: Run tools like HijackThis/OTL/ComboFix to get rid of junk.
  13. Reboot and enjoy your clean system.
  14. Optional: Run the rootkit scanner again.
  15. Make sure your computer is sufficiently protected!

Some remarks:

  • Autoruns is written by Microsoft and thus shows any locations of things that automatically start...
  • Once software is unchecked from Autoruns, it will not start and can't prevent you from removing it...
  • There do not exist rootkits for 64-bit operating systems because they would need to be signed...

It is effective because it will disable malware/spyware/viruses from starting,
you are free to run optional tools to clean out any junk that was left on your system.

Improve this answer
2
  • I will add this to my list of tools if I ever have a problem. The only issue I have with your method is that I have seen malware embed itself into .EXE file extensions so that it launches in the background any time you try to launch any EXE file. Also, I have seen it load itself into the actual web browser itself (hence why I say to do an Internet Explorer reset after you are finished.)
    – James Watt
    Commented Jul 25, 2010 at 18:58
  • That's why you let a top virus scanner scan your computer for malware embedded into .EXE files. And the malware shouldn't start if you have a good on-access scanner running... :-)
    – Tamara Wijsman
    Commented Jul 25, 2010 at 19:01

Not the answer you're looking for? Browse other questions tagged .