Tip: How to handle Malware

A general guide to removing most malware and viruses.

Author: Neil Patterson :: 2024 Expertek
Views: 3934 - Updated 6/24/2015 12:35 am Print this tip

There are 2 Main Methods of attacking the attackers:

The first and obvious choice will be discussed at length, Cleaning the system of its infected programs and related files,preserving the data and configuration as much as possible (sometimes additional steps are required, such as correcting issues stemming from the malware removal). The second choice is more extreme, and involves backing up your data, and re-installing everything.

Most people prefer to save themselves the hassle of starting over with a fresh install, (though in some cases, it may be required anyhow), so we try to clean the system first. There are many paid and free scanners out there on the web, a few of the best (most reliable without false positives) we have found are: Malwarebytes, Ad-Aware, and Spybot S&D. A reliable scanner is really helpful because it searches for signs of malware and confirms your suspicions, and then offers to remove the items for you. On the downside of scanners, it is not always obvious what should be removed and some removal programs generate False Positives (an indication that a uninfected file or registry entry is malware when it is not) and removal of files or registry entries that affect your PC ability to boot or use some of the features. Automatic scanners are really a lot easier than the next step, but this next step may be required when scanners let you down. Keep in mind that the BIG Corporate entities do NOT remove viruses for free, so McAfee and Norton have some advertising-ware they distribute, which will update and scan just like their Paid, fully functional counterparts, but will not remove any items that turn up in their results, you must buy their software or pay for support.

Next, try Manual Removal.

Manual removal of Malware is not always easy, and the best method is to examine your startup programs, the processes that are running in the background, and then Identifying these programs as to whether or not you need them and uninstalling or disabling the ones you don't. Here are some of the steps you need to follow to do a review of the programs that are starting up automatically on your computer:

  1. Run MSCONFIG, go to the Startups tab, and click the button to "Disable all" programs (this does NOT uninstall these programs, merely stops them from running on the next boot, and they should not start until they are re-enabled the same way). Sometimes, malware will prevent this program from starting, as it will allow you to turn off their junk. If msconfig won't run, try restarting in safe mode. Note that Windwos 8 and above have a different screen and will refer you to task managers startup tab. The same suggestions apply.

  2. Go to the Services Tab, click the box marked "Hide all Microsoft services" and then disable the items that remain. (These are third party services that are not required to start your PC.)

  3. Click OK now, and the system will offer to reboot, do so, and when you log back in, you will get a message that indicates that the system is running in Troubleshooting mode. Check the "Don't show this dialog" box when it pops back up, otherwise you'll get it every time you reboot.
  4. Select the Startups Tab again, and see if any items there have re-enabled themselves. These re-enabled items are typically malware. You can check these items out by going to http://sysinfo.org/ and searching for the name of the program in their Startups database. This will help to identify the type of program, and you can usually determine if you need it from there. Make a note of the file or program name for removal during one of the next steps.
  5. Next, bring up Task Manager (in XP Home, press ctrl-alt-del), then select the Processes Tab.

  6. Click the column header labeled "username" and then review the items that are listed by your login name. If all is well, you should see, MSCONFIG, TASKMAN, EXPLORER and not much else. other items should be checked under http://sysinfo.org/. Be sure to make a note of the program names for later removal.
  7. Using Task Manager, stop these rogue processes from running, then search your computer for the program name, and delete it. (TIP: if you view details before deleting the file, you can see the date (and TIME) that the file was created/modified on your hard drive, then you can then look for other files created or modified about the same time. (These files CAN be removed as well, in most cases, though generally it is wise to move then to a safe area in case they are required to boot.)
  8. Reboot and repeat steps 4 (select the STARTUPS Tab) through 7 until the signs of the malware have gone away. Lastly, Run MSCONFIG one final time and re-enable the programs you want to start automatically on each boot.

If there are no signs of malware during the above steps, you may actually be experiencing a hardware problem or a software conflict, try selectively re-enabling the startup items a few at a time and rebooting to see if the problem recurs, if and when it does, narrow down the last few items you enabled and reboot until you have determined which program is causing the issue.

Programs like Hijackthis are extremely effective, but ONLY if you know how to use them. Be sure to get some help and at the very least, google search any terms or items that you're not familiar with.

Last Resort: Format the Hard Drive & Re-install Windows:

Okay, you've tried a few of the recommended scanners, and gone thru the manual removal steps, and are still having issues. In this situation, it is possible that your registry is very messed up, or you may be having a hardware issue as well. To confirm that your hardware is OK, it will be best to back up your data, format, and re-install. The Windows installation process is very hardware intensive and will reveal any hardware defects by giving errors during the install. If you are unfamiliar with this process, please consult with an expert technician to ensure a proper backup of data, and then getting the OS & drivers reloaded properly. Call us @ 901-837-7799 for assistance!!

Here's a good FREE Anti-Spyware Program:

And here's a good FREE Spyware Inspection/Disabling Program:

Back to the TechTips Index | MALWARE Index

Did you enjoy "How to handle Malware"??

If you Liked it, SHARE IT!



Ask a question, or Leave a comment below!