Remove a virus from your PC image

Remove a virus from your PC

This is a list of things to do if you have an active infection. It can be hard to download when your computer is under attack so I recommend getting them ready for the sad day you need them, just remember to get the latest versions at that time if you can. Create a folder on the windows desktop dedicated to computer cleaning. Create a subfolder under that called "Virus Damage Control" and install the following programs under that folder. It is important to have them organized so you can track the type of program it is so you know when to run them.

?

What type of computer do you own?

Mac
PC
Both

Kasperskey Rescue CD

Create a Kasperskey Rescue CD and run it at computer startup. This is the disk you will run right away at boot time if a virus does happen to get through your defenses. Since it runs before windows starts it can do a deeper scan of the whole windows environment find things that are not locked out by running windows processes. If you are infected or you have been infected in the past and have not run a boot time checker, this is your first step.

RKill malware process terminator

"RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes so that your normal security software can then run and clean your computer of infections. When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies that stop us from using certain tools. If you have an infection that you are finding hard to remove, run RKill first and retry." ~ BleepingComputer.com I am putting this here first so that you don't waste time later running something that is blocked by the malware.

FixExec file associations correction

FixExec is a program that is designed to fix executable file associations for the .bat, .exe, and .com file extensions. If the program detects any of these associations are missing, changed, or hijacked, the settings will be set back to the original Windows defaults. Malware can cause all sorts of trouble that makes it hard to remove. Making sure your basic system file associations are correct will eliminate frustration when you try to run the actual malware removal program.

ComboFix

ComboFix is an aggressive expert virus removal program. They say you should only run it with supervision but if you don't have a computer expert around and you are suffering from an infection or you are not sure you have fully cleaned one up in the past, run it. Otherwise, save this one for when you have a virus. Its like a strong dose of computer Antibiotics. Please read the directions before running: http://www.bleepingcomputer.com/combofix/how-to-use-combofix It runs without any interaction. Just make sure to shut everything nonessential down, deactivate any current antivirus products you have on the machine. Then don't touch your machine while it runs.

HijackThis startup program identification

HijackThis is a program that can be used to spot programs that you do not want to start automatically. This program is a not anti-virus program, but it shows you what is starting up automatically on your computer as well as other configuration information that is commonly hijacked. Since there is no filter on what it reports, you will get alot of information from it and should research each entry before you remove anything using this tool. Usually people who are experts request the output of this file after virus removal tools are run so that they can spot anything suspicious left around. The instructions state "You should only use HijackThis if you have advanced computer knowledge or if you are under the direction of someone who does. Improper usage of this pr ogram can cause problems with how your computer operates." This is true if you use it to remove anything but you can run it just to give you a list of what is starting up on your computer. You should look up each process on the internet to have a basic understanding of what is running on your computer. Hopefully you will not find any problems. If you find something suspicious, please see the link to the HijackThis Tutorial on bleepingcomputer.com.

Downloadable computer repair CD's

If for some reason the above resources do not work, then here is a large list of available computer repair assets. Each anti-virus uses different methods to detect viruses and running some other scanners at boot time could be a good idea if you still have problems. (Alternate list: http://www.technibble.com/large-list-of-useful-computer-repair-cds/)