Malware Removal Guide

[ttam]

This is my personal preference on removal or spyware and what I found to work the best. If you have a difference of opinion please keep it civil and don't post (while having a heartattack) to tell me how wrong I am. These are steps that I've done daily, for many years, while working in computer repair shops.

 

These are also great steps for those of us that are more computer savvy, because the junk files still accumulate up on our computers even if were extra cautious.

 

Step #1 -

I prefer a clean boot into Windows NORMAL mode.

You only need to boot into Safe Mode if there are things you want to avoid from opening at startup.

Disable your anti virus to make sure no conflicts happen.

 

Step #2 -

Program time. I run a few different programs depending on what I need. They are all small programs and live on my flash drive.

 

#0 RKill - http://www.bleepingcomputer.com/download/rkill/ - Mainly optional. It runs real quick and kills processes.

#1 AdwCleaner - http://www.bleepingcomputer.com/download/adwcleaner/ - Run this, it's a pretty fast scan that will restart your computer.

#2 Hitman Pro - http://www.surfright.nl/en/downloads - Choose the 32 or 64 bit option. I run this as the second scan, it finds most of the things were searching for. I always enter a fake email for the 30 day trial version. Normally in a shop, I won't need to use it again.

#3 JRT - http://www.bleepingcomputer.com/download/junkware-removal-tool/ - It's a basic command prompt tool, it's found things others have not and it made it's way into my tool kit.

#4 TDSSKiller - http://www.bleepingcomputer.com/download/tdsskiller/ - Normal and quick rootkit scanner.

#5 Combofix - http://www.bleepingcomputer.com/download/combofix/ - This is my last scan. It normally finds the rest and all of it. It's the longest scan and will also sometimes restart your computer. After it's done, press Windows Key + R and type combofix /uninstall

 

Not badly infected? Do just steps #1, 2 and run CCleaner

 

Ad Block Plus! This is a great browser extension that stops a lot of the ads, etc that lead to malware.

For Chrome > https://chrome.google.com/webstore/detail/adblock-plus/cfhdojbkjhnklbpkdaibdccddilifddb?hl=en-US

For Fireox > https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

For Internet Explorer > http://www.google.com/chrome Just install chrome already...

 

Step #3 -

Malwarebytes & Kapersky Rescue Disc @ Stubborn infections

This is a great step if you have a USB dock or able to hook up a drive as a secondary drive.

 

Malwarebytes Anti Malware

Thisis where Malwarebytes shines in my book.

Program can be found here > http://www.malwarebytes.org

Being one of the few programs able to scan a chosen drive makes Malwarebytes a go to program when a drive is way to infected to even get into Safe Mode on.

 

By clicking "Perform Full Scan" it gives you the option to choose which drive. So if you have a drive hooked up as G: by usb, you can elect to scan only that drive. 

This scan does take a decent length of time, but it's worth the wait when you need access to the drive.

 

Kapersky Rescue Disc

This is another great program to have, and since it's a bootable enviroment, it's a great CD to have in your arsenal.

ISO can be found here > http://support.kaspersky.com/us/viruses/rescuedisk

 

This boots into a comfortable setting where you can scan the drive without having to boot into Windows. All you need to do is down the 500MB or so ISO and burn it to a CD.

 

Simply press F12 or your designated Boot select key, and boot to the CD.

Wait for it to boot into a friendly UI. 

Open up the program "Kaspersky Rescue Disc" on the Desktop and hit Scan Computer

 

Step #4 -

Clean up time. This is the fun part of removing junk programs, temp files and the such.

 

CCleaner - https://www.piriform.com/ccleaner - Great basic file system cleaner. Removes the junk temp files.

Revo Uninstaller - http://www.revouninstaller.com - Program uninstaller. Pretty self explanatory.

PCDecrapifier - http://pcdecrapifier.com - Great and fast tool to remove trash programs.

 

 

 

Honorable mentions:

 

Autoruns (http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx) is another great tool to check the system auto runs as the name mentions. Lets you see some goodies Please do read up on how to use it before going and clicking on stuff.

Web of Trust (https://www.mywot.com) Recommended by brownninja97 - WOT is a browser extension based on a review system for bad websites that will give informed decisions about whether to trust a website

D7 (http://www.foolishit.com/d7/) is an all in one Windows malware/tweak tool that I've used like 3 times but it's still cool.

 

That's it. Nice and simple malware removal for the every day person. There really isn't much to the process, takes a whole 10 minutes, maybe more depending on the speed of the system and how much Combofix finds. 

[Asgarth]

Nice little guide, I'll be trying this

[ForeseenVisionz]

Malwarebytes anyone?

[chicksoup]

very useful my granddad's pc could use this

[colonel_mortis]

Definitely put malwarebytes on the list as well.

[JAKEBAB]

Jeez your really going hardcore on that malware lol good tut is there anyway i can save this thread?

[ttam]

Definitely put malwarebytes on the list as well.

 

 

Malwarebytes anyone?

 

Maybe as an honorable mention but the program just takes way to long to find anything when others find it within seconds. It's a great program for those who have time to wait or something I would recommend to a computer 'newbie'

[ForeseenVisionz]

Maybe as an honorable mention but the program just takes way to long to find anything when others find it within seconds. It's a great program for those who have time to wait or something I would recommend to a computer 'newbie'

Run it in the background then.

[colonel_mortis]

Maybe as an honorable mention but the program just takes way to long to find anything when others find it within seconds. It's a great program for those who have time to wait or something I would recommend to a computer 'newbie'

Well it does take a bit of time, but it's much better than a lot of alternative solutions at finding malware. There's no portable version (last time I looked) though, which is a bit of a problem for the context.

[ttam]

Run it in the background then.

 

 

Well it does take a bit of time, but it's much better than a lot of alternative solutions at finding malware. There's no portable version (last time I looked) though, which is a bit of a problem for the context.

It's to slow lol. Adwcleaner and hitman find everything Malwarebytes finds and doesn't find in 2 minutes.

 

Just like the little exert from the end of the post

"Yes, I know there is no Malwarebytes. It's a great program but takes way to long and these programs do all the work and MB never finds anything but a tracking cookie afterwards."

[needmorewood]

i checked an entire 1tb in 10 minutes on malwarebytes...... to me thats not that long

overall a nice giude!

[brownninja97]

I only bust out combofix when shit gets serious, combofix is the big gun of the virus removal software.

[ttam]

Well it does take a bit of time, but it's much better than a lot of alternative solutions at finding malware. There's no portable version (last time I looked) though, which is a bit of a problem for the context.

 

A portable, quicker scanning Malwarebytes would actually be nice to have.

[brownninja97]

Maybe as an honorable mention but the program just takes way to long to find anything when others find it within seconds. It's a great program for those who have time to wait or something I would recommend to a computer 'newbie'

This isnt really virus removal but i recommend you put web of trust up there, it black lists bad websites, eg screamers or scam websites owned by Nigerian princes. Its community based where tech guys review the websites, its standard 1kb plugin for a browser and is pretty awesome, i know its prevented viruses because every now and then one of my customers calls me asking about a website it flagged up. Luckily its community is great, ive not seen any troll reviews as of yet and it works very well, my logic of this is why remove a virus when you can stop it from being downloaded in the first place.

[ttam]

This isnt really virus removal but i recommend you put web of trust up there, it black lists bad websites, eg screamers or scam websites owned by Nigerian princes. Its community based where tech guys review the websites, its standard 1kb plugin for a browser and is pretty awesome, i know its prevented viruses because every now and then one of my customers calls me asking about a website it flagged up. Luckily its community is great, ive not seen any troll reviews as of yet and it works very well, my logic of this is why remove a virus when you can stop it from being downloaded in the first place.

Added it as a honorable mention.

I've heard of it here and there but have never looked into it.

[brownninja97]

Added it as a honorable mention.

I've heard of it here and there but have never looked into it.

I recommend you install it on customers pc whether they like it or not they need it, the amount of support calls ive got has dropped by around 40% in the last two months which ive got into it. 

[ttam]

I will tidy this up some when I get home. Just did it as a hey I've got 10 minutes free at work so I'll do this kind of thing

[TimGOAT]

add malware bytes to that list

[TheMissxu]

I'll have to give AdwCleaner a try sometime

[ttam]

add malware bytes to that list

It's in there as a honorable mention.

Adwcleaner finds everything Malwarebytes does and much more in just 1 minute.

[tedjani]

thanks this will be helpful to me 

[Ddm5]

 

Malwarebytes (http://www.malwarebytes.org) Don't get me wrong, it's a great malware program. It takes a lot of time for a decent scan. Adwcleaner finds everything Malwarebytes does in 1/10th the time. This is what I recommend to a distant elderly relative to run themselves. 10, 20 minutes isn't to bad for a full system scan. If it was a portable file like the rest, it wouldn't be so bad.

 

This, Adwcleaner is used more often or not to remove Browser based Adware. It stretches beyond that and can actually be used for system wide Adware removal / detection, Malwarebytes goes beyond this and scans every file seperately, Malwarebytes detects Malware and Adware where as Adwcleaner only targets the Adware, hence the name. 

[christianled59]

I have found a much simpler solution to all of your malware issues.

[Akolyte]

Thats a good guide.  I've dealt with some very bad infections since I have connections with AVG and am expected to deal with them.  I would add Kaspersky rescue disk.  You would be surprised at how much malware can hide once the system has started up.  

[ttam]

Small update with some offline / external scan options like Malwarebytes and Kaspersky Rescue Disc.