How To Cure A Malware Infection
3 Easy Methods
What do you do when your PC is displaying all the signs of having been infected and/or hacked but your antivirus and anti-spyware scan reports come back clean.. or fail to remove the infection?
This was the case for a fella who called me for advice recently. He had done things ‘right’ — and by that I mean he has a firewall, he keeps his antivirus definitions up to date, 
and he runs a couple of anti-spyware applications — but suspected his machine had been hacked anyway.
He couldn’t do things he was used to doing (like deleting a file) and his machine was “really slow.” But according to his scanners, his machine is in perfect shape!
He was right, btw, he was infected.
Tip of the day: If you should find yourself in a similar situation there are several steps you can take to help resolve your questions and (hopefully) fix your machine without taking the drastic step of wiping your hard drive, formatting, and reinstalling Windows.
The first step is to use a scanner that isn’t installed on your machine. Here’s two ways to do that: one, if your antivirus allows it (and most of them do these days), follow its instructions and make an antivirus recovery disk. This is a bootable disk that scans your system before Windows loads.
[note: for a quick method to create an AV disc, keep reading..]
To use one, put it in your CD tray and restart your machine. A plain-text sentence will appear* telling you to “press any key to boot from CD…” When you see it, hit your spacebar or, well, any other key, and then follow the instructions. When it’s finished, remove the CD and restart your machine again. (* If you don’t get a “press any key” prompt, you need to set the boot order in your BIOS. For instructions, click here.)
[note: you may also use a properly prepared USB thumb drive. Click here to read my article on how to do that.]
A second method is to use an online scanner. I have a list, with links, of several good online scans on my website, here. (My reco is Housecall) Quite a few of the online scanning tools will try to sell you their full application, but you’re under no obligation to buy. The big advantage to these two methods lies in the fact that they have not been compromised, or altered, and the files and scanners on your machine may be– the modification being done by the virus or hacker specifically to thwart your removal attempts.
[note: most modern malware blocks access to these sites. If that happens, do the repair found here, Can’t Download? Reset IE, and then try.]
Another thing to do is scroll down to my “Today’s free download” and download HiJack This!. Run it and dump the result into a .txt file (there’s instructions for this) and then register on one of the HiJack This! forums (there’s instructions for this too) and post your results there. Before too long, an expert anti-malwareologist [don’t bother looking: I just now made that word up] will have looked over the intricacies, and will post their analysis and instructions. These folks are really, really good at what they do, and you can trust their answers. These volunteers get a big tip of my hat.
Hopefully these efforts will be rewarded with a rejuvenation of your machine, and you will be back in business again. If not, you have my sympathy. You may have a rootkit and then your best solution is to re-format your hard drive and reinstall everything, or enlist the aid of a professional. There’s no shame in that last — the modern versions of viruses and worms are devilishly difficult to remove.
Today’s free downloads:
HijackThis™ is a free utility which quickly scans your Windows computer to find settings that may have been changed by spyware, malware or other unwanted programs. HijackThis does not clean infections, but creates a report, or log file, with the results of the scan. A large community of users participates in online forums, where experts help interpret the scan results to clean up infected computers.
Avira AntiVir Rescue System This is a small download that, when launched, will create a self-contained anti-virus disc with the latest definitions. All you have to do is insert a blank CD. (You may have to go to an un-infected machine to do this..) It will boot even if your machine won’t load Windows. Avira gets a big tip of my hat for offering this free tool, too!
Today’s recommended reading: How to Protect Your Child on the Internet
Copyright 2007-9 © Tech Paul. All rights reserved. post to jaanix
| Share this post : |  |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
6 Comments »
Post your Comment/Question
• About Tech Paul
I am a Retired computer & network technician. I used to think the machines were pretty cool. Now I don’t.
They’re anything but.
I regularly posted how-to’s and tricks & tips and general computing advice here starting in 2007. (Use the Search tool to find answers. But be aware, many are rather dated.) Sometimes I answered (your) specific questions in an article if I believed the answer was generally helpful to “everyone”. All the writing you see was my own, typos and all. There always is/was an implied “IMHO” in what you see here.
Note: You are responsible for using this blog and its content. I am in no way liable for any losses caused by user error, viruses and/or other malware, hardware or software failure, or any other conceivable reason.
-
Say "thank you!" Buy Tech Paul a cup of coffee (and keep T4E ad free).
-
-
McAfee® Cybersafety Resource Portal, an online help center designed to assist victims of computer crime and provide information on how to avoid becoming a victim.
-
Subscribe to Tech--for Everyone by EmailRecent Comments
-
-
-
-
Also:
-
-
Tech - for Everyone 
What a terrific article.
Each time I visit your site I’m reminded how well your readers are served by your timely, and well researched articles.
Your technical and presentation skills, make reading and understanding your articles easier than on many other sites.
Thanks for the great work, and the tip on AntiVir Rescue disk.
BM
LikeLike
Thank you for the very kind words. I know that Avira is one of your top free antivirus recommendations (and one of mine as well). This “instant AV CD” tool does deserve special mention, I thought.
Some good people over there.
Now.. if we could just do something about the source of malware.. instead of being in a “reacting mode” all the time (and trying to play ‘catch-up’)..
LikeLike
Great article and sound advice on using a bootable disk to scan before Windows loads. I’m going to download the Avira Rescue disk. Two other antimalware products that seem to be highly regarded these days are Malwarebytes and SUPERAntiSpyware.
I’m also using RUBotted from Trend Micro to check for bots on my system although it seems to give the occasional false (I hope) positive. Have you any experience with this?
LikeLike
Thanks for stopping by.
I have no disagreements w/you on the two antispyware’s, but my personal preference (in the strictly free department) is Spyware Doctor combined with Threatfire.
I have run RUBotted on both XP and Vista (a laptop and desktop, one of each) and never had a false positive. That doesn’t mean they don’t happen, of course.
But I don’t view it as a permanent installation type of application, more of a diagnostic tool (to confirm suspicions), and I remove it after 48 – 72 hours of use, generally, as I’m a big believer in lean, mean machines (we load far too many programs on our computers, and then only use a third [or less] of them).
LikeLike
Ryan,
I have pulled your comment. It was confusing and poorly written… and probably (if I understood what you were trying to describe) not appropriate for “everyone”.
I appreciate the input, though, and I thank you.
LikeLike
[…] of the day: For a great primer on how to remove malware read TechPaul’s “How To Cure A Malware Infection – 3 Easy […]
LikeLike