<

Virus Removal Methods

Published on
21,969 Points
3,969 Views
15 Endorsements
Last Modified:
Approved
A very common problem I get from the average user is they have an issue with viruses, malware, and spyware.  There are numerous articles out there on how to remove viruses and over the course of time I have developed my own little method that has worked out for me with a great percentage of success.  I have been removing viruses, malware, and spyware pretty much ever since I became a technician and here is my method.


System Restore

Perform a System Restore: Boot up in safe mode with command prompt.

Type rstrui.exe and restore your computer to a few days ago.


**Note** Restore the system to a date before the infection occurred or was 1st noticed.


Virus Removal Tools

Download the Following Tools

CCleaner: http://www.filehippo.com/download_ccleaner/
TDSSKiller: http://www.bleepingcomputer.com/download/tdsskiller/
RogueKiller: http://www.bleepingcomputer.com/download/roguekiller/
Adwcleaner: http://www.bleepingcomputer.com/download/adwcleaner/
Malwarebytes: http://www.bleepingcomputer.com/download/malwarebytes-anti-malware/

Run the tools in this order

    1)  TDSSKiller
    2)  RogueKiller (scan, fix host, fix proxy, fix dns)
    3)  Adwcleaner: (Scan, Clean)
    4)  Malwarebytes: (download all updates and run a full scan)
    5)  CCleaner


Boot Sector Virus

If you have trouble since some viruses cannot be detected in Windows (Boot Sector).  You can burn a bootable antivirus to scan your system before loading windows.

Kaspersky Rescue Disk
http://support.kaspersky.com/us/4162
Burn the Image out to disc or load onto a bootable flash drive.  Run a scan, delete viruses, and reboot.

Crypto-Locker

This is a nasty virus that encrypts your files and demands payment to decrypt those files.  At this time there is no method of decrypting the files and only way of getting your data back is from the following options.

1) Restore files from backup (having a backup is always advised)

2) **Use at Own Risk** is to pay the ransom.  Some cases have reported roughly a 2 - 4 hours for the decryption process while others state the decryption failed so they lost money regardless.

Methods of handling the Crypto-Locker can be found here:  Crypto-Locker Guide

Final Note

At this point if none of the above worked to resolve the issue, I take a backup of the data and do a wipeout and reinstall of the operating system (can't win every battle).  In essence you have spent an hour or so to remove the virus and typically a wipeout and reinstall + data transfer only takes about 1 1/2 to 2 hours.

**Advisory** Recommend loading an antivirus and scanning data before transfering it back onto the fresh install to prevent a possible chance of transfering the virus/malware back onto your system.  

Thank you and if you like my articles please check yes if it was helpful :).

Best,

Nick Rhode
15
Comment
Author:Nick Rhode
3 Comments
 
LVL 75

Expert Comment

by:käµfm³d 👽
At this point if none of the above worked to resolve the issue, I take a backup of the data and do a wipeout and reinstall of the operating system (can't win every battle).
But isn't there a chance that you're re-installing the same virus right back on to your fresh install? Do you scan the data before you load it back onto the machine?
0
 
LVL 22

Author Comment

by:Nick Rhode
In a sense.....yes.  Your typical virus/malware is not going to attach to your data and is instead hidden within other directories outside the common data folders.  Just as a precaution I will update the article to reflect your comment and advise scanning the data prior to transfering it back to the workstation.  Thank you for your comment and recommendation :)

Cheers!
0
 
LVL 13

Expert Comment

by:akb
I've had a couple of clients recently with rootkits which tdsskiller hasn't found. Malwarebytes anti-rootkit (under More Tools tab) has found and cleaned these successfully each time.
0

Featured Post

How do you know if your security is working?

Protecting your business doesn’t have to mean sifting through endless alerts and notifications. With WatchGuard Total Security Suite, you can feel confident that your business is secure, meaning you can get back to the things that have been sitting on your to-do list.

Join & Write a Comment

In response to a need for security and privacy, and to continue fostering an environment members can turn to for support, solutions, and education, Experts Exchange has created anonymous question capabilities. This new feature is available to our Pr…
Basic Overview of office 365 user portal
Other articles by this author

Keep in touch with Experts Exchange

Tech news and trends delivered to your inbox every month