Sunday, June 5, 2011

How home users can (possibly) remove malicious software

Malware is a generic term describing spyware, worms, viruses, trojans, adware, keystroke loggers, homepage hijackers, search engine redirectors, and anything else that may have been installed by deceptive means.

I could try to make a comprehensive guide on how to remove malware, but there are several already out there that are better supported than I could ever do myself.
Two of the best ones I have found are combofix and MalwareBytes antimalware


Combofix is quick and easy to use, typically taking about 10 minutes and sometimes gets the job done where others fail. It can be found here:


The guide there is comprehensive and is a good first step.

The biggest weakness of combofix (and ironically not really their fault) is that some antiviruses will block some of their processes. One antivirus in particular is so bad that combofix will refuse to run until it is uninstalled.

I also tries to install the recovery console as a bootup option, which will be helpful if the virus (or its removal) makes any bootup problems.

They have forums to analyze the final logs, but unless you want to spend a lot of time and effort I would suggest holding onto it for now.

Next is MalwareBytes antimalware. (I suggest the free version):


Install it, update it, run a scan.
Remove everything it detects (this may disable software that requires advertising to run, but you can reinstall those items if you still need them later).

Their forum has better instructions for it here:


And they also tell you how to run several other scanners, install and use a free antivirus, and post to their forums if it didn't all get removed.

What if I can't get on the internet?
Get a thumbdrive, usb memory stick, flashcard, sd card, blank cd, etc. and take it to a computer that can get on the internet, download the software, and bring it back to the infected computer to run.

What if it doesn't work?
If you have more time than money, check out the forums and tutorials at Malwarebytes. You can start with the forum link above (http://forums.malwarebytes.org/index.php?showtopic=69723).
Otherwise I suggest taking it into a repair shop.

What if my computer will not boot at all or will not let me run any software (because of a virus)?
I suggest getting an antivirus boot disk (several antivirus vendors have one).
I recommend using one from a vendor you recognize. Here are links to some I have used in the past:




What if my files are missing (because of the virus)?
The malware may have hidden your files. Try this page to view hidden files:
once you can see them you can right-click on them, go to properties on the drop-down menu, and un-check the hide box selection.
p.s. I am not a paid advertiser for any products listed above nor do I have any association with them. They are just tools I have used in the past that have worked for me.

1 comment:

  1. If combofix and the installed antivirus don't get it I usually need to reformat anyway.

    ReplyDelete