Computer is infected by a virus or a malware, what do I do now?

Question

What should I do if my Windows computer seems to be infected with a virus or malware?

• What are the symptoms of an infection?
• What should I do after noticing an infection?
• How can I get rid of it?

(This question comes up frequently, and the suggested solutions are usually the same. This community wiki is an attempt to serve as the definitive, most comprehensive answer possible. Feel free to add your contributions via edits.)

Answer 1

How can I tell if my PC is infected?

General symptoms for malware can be anything. The usual are:

• The machine is slower than normal.
• Random failures and things happening when they shouldn't (e.g. some new viruses put group policy restrictions on your machine to prevent task manager or other diagnostic programs from running).
• Task manager shows a high CPU when you think your machine should be idle (e.g. <5%).
• Adverts popping up at random.
• Virus warnings popping up from an antivirus you don't remember installing (the antivirus program is a fake and tries to claim you have scary sounding viruses with names like 'bankpasswordstealer.vir'. You're encouraged to pay for this program to clean these).
• Internet pages redirected or blocked, for example, home pages of AV products or support sites (www.symantec.com, www.avg.com, www.microsoft.com) are redirected to sites filled with adverts, or fake sites promoting bogus anti virus / "helpful" removal tools, or are blocked altogether.
• Increased startup time, when you have not been installing any applications (or patches)... This one is awkward.
• Anything out the blue, if you "know" your system, you typically know when something is very wrong.

---

How do I get rid of this?

Using a Live CD

Since the infected PC's virus scanner might be compromised, it's probably safer to scan the drive from a Live CD. The CD will boot a specialized operating system on your computer, which will then scan the hard drive.

There are, for example, Avira Antivir Rescue System or ubcd4win). More suggestions can be found at FREE Bootable AntiVirus Rescue CDs Download List such as:

• Kaspersky Rescue CD
• BitDefender Rescue CD
• F-Secure Rescue CD
• Avira Antivir Rescue Disk
• Trinity Rescue Kit CD

Connecting the hard drive to another PC

If you are connecting the infected hard drive to a clean system in order to scan it, make sure that you update the virus definitions for all the products that you will be using to scan the infected drive. Waiting a week to let the antivirus providers release new virus definitions can improve your chances of detecting all the viruses.

Make sure your infected system remains disconnected from the internet while it is infected. This will prevent it from being able to download new editions of viruses (among other things).

Start with a good tool such as Spybot Search and Destroy or Malwarebytes' Anti-Malware and perform a full scan. Also try ComboFix, and SuperAntiSpyware. No single antivirus product will have every virus definition. Using multiple products is key (not for real time protection). If even just one virus remains on the system, it may be able to download and install all the latest editions of new viruses and all the effort so far would have been for nothing.

After this has finished, use Microsoft / Sysinternals Autoruns and look through most of the tabs (you especially want to pay close attention to Logon and Scheduled tasks) and delete most of the items that you think are viruses or research them first. Autoruns has an option that lets you scan an offline or secondary (infected) hard drive from a clean system. Use the "Analyze Offline System" option here.

What to do after restoring

Now it should be safe (hopefully) to boot into your (previously) infected system. Still, keep your eyes open for signs of infection. A virus can leave changes on a computer that would make it easier to re-infect even after the virus has been removed.

For example, if a virus changed DNS or proxy settings, your computer would redirect you to fake versions of legitimate websites, so that downloading what appears to be a well-known and trusted program could actually be downloading a virus.

They could also get your passwords by redirecting you to fake bank account sites or fake email sites. Be sure to check your DNS and proxy settings. In most cases, your DNS should be provided by your ISP or automatically acquired by DHCP. Your proxy settings should be disabled.

Check your hosts file (\%systemroot%\system32\drivers\etc\hosts) for any suspicious entries and remove them immediately. Also make sure your firewall is enabled and that you have all the latest Windows updates.

Next, protect your system with a good antivirus. Microsoft Security Essentials is often recommended along with other products.

What to do if everything fails

It should be noted that some malware is very good at avoiding scanners. It's possible that once you are infected, it can install rootkits or similar to stay invisible. If things are really bad, the only option is to wipe the disk and reinstall the operating system from scratch. Sometimes a scan using GMER can show you if you have a rootkit.

You may want to do a few runs of Spybot Search and Destroy. If after three runs it is unable to remove an infestation (and you fail to do it manually) consider a re-install.

Another suggestion: Combofix is a very powerful removal tool when rootkits prevent other things from running or installing.

Using multiple scan engines can certainly help to find malwares best hidden, but it's a fastidious task and a good backup/restore strategy will be more efficient and secure.

---

Bonus: There is an interesting video series beginning with, "Understanding and Fighting Malware: Viruses, Spyware" with Mark Russinovich, the creator of Sysinternals ProcessExplorer & Autoruns, about malware cleaning.

Answer 2

There are some great malware-fighting tips in Jeff Atwood's "How to Clean Up a Windows Spyware Infestation". Here's the basic process (be sure to read through the blog post for screenshots and other details that this summary glosses over):

1. Stop any spyware currently running. Windows' builtin Task Manager won't cut it; get Sysinternals Process Explorer.
   1. Run Process Explorer.
   2. Sort the process list by Company Name.
   3. Kill any processes that don't have a Company Name (excluding DPCs, Interrupts, System, and System Idle Process), or that have Company Names that you don't recognize.
2. Stop the spyware from restarting the next time the system is booted. Again, Windows' builtin tool, MSconfig, is a partial solution, but Sysinternals AutoRuns is the tool to use.
   1. Run AutoRuns.
   2. Go through the entire list. Uncheck suspicious entries -- those with blank Publisher names or any Publisher name you don't recognize.
3. Now reboot.
4. After rebooting, recheck with Process Explorer and AutoRuns. If something "comes back", you'll have to dig deeper.
   • In Jeff's example, one something that came back was a suspicious driver entry in AutoRuns. He talks through tracking down the process that loaded it in Process Explorer, closing the handle, and physically deleting the rogue driver.
   • He also found an oddly-named DLL file hooking into the Winlogon process, and demonstrates finding and killing the process threads loading that DLL so that AutoRuns can finally remove the entries.

Answer 3

Follow the order given below to disinfect your PC

1. On a PC that is not infected, make a boot AV disc then boot from the disc on the Infected PC and scan the hard drive, remove any infections it finds. I prefer the Windows Defender Offline boot CD because it can remove boot sector viruses, see "Note" below.

   Or, you can try out some other AV Boot discs.

2. Install free MBAM, run the program and go to the Update tab and update it, then go to the Scanner Tab and do a quick scan, select and remove anything it finds.

3. When MBAM is done install SAS free version, run a quick scan, remove what it automatically selects.

4. If windows system files were infected you may need to run SFC to replace the files, you may have to do this offline if it will not boot due to the removal of the infected system files. I recommend you run SFC after any infection removal is done.

5. In some instances you may have to run a startup repair (Windows Vista and Windows7 only) to get it booting properly again. In extreme cases 3 startup repairs in a row may be needed.

These last 2 are not AV softwares like Norton, they are on demand scanners that only scan for nasties when you run the program and will not interfere with your installed AV, these can be run once a day or week to ensure you are not infected. Be sure you update them before each daily-weekly scan.

Note: that the Windows Defender Offline product is very good at removing persistent MBR infections which are common these days.

.

If you have a single infection that represents itself as software, ie "System Fix" "AV Security 2012" etc, see this page for specific removal guides

.

Answer 4

The possible solutions for a virus infection are in order: (1) antivirus scans, (2) system repair, (3) total reinstall.

Make first sure that all your data is backed up.

Load and install some antiviruses, make sure they are up to date, and scan deeply your hard disk. I recommend using at least Malwarebytes' Anti-Malware. I also like Avast.

If that doesn't work for any reason, you may use a rescue live-CD virus scanner : I like best Avira AntiVir Rescue System because it gets updated several times a day and so the download CD is up-to-date. As a boot CD it's autonomous and doesn't work using your Windows system.

If no virus is found, use "sfc /scannow" to repair important Windows files.
See this article.

If that also doesn't work, you should Perform a Repair Installation.

If nothing works, you should format the hard disk and reinstall Windows.

Answer 5

My way of removing malware is effective and I have never seen it fail:

1. Download Autoruns and if you still run 32-bit download a rootkit scanner.
2. Boot into Safe Mode and start Autoruns if you are able to, then go to step 5.
3. If you can't get into Safe Mode, connect the disk to another computer.
4. Start Autoruns on that computer, go to File -> Analyze Offline System and fill it in.
5. Wait for the scan to be done.
6. In the Options menu, select everything.
7. Let it scan again by pressing F5. This will go quick as things are cached.
8. Go through the list and uncheck anything that is conspicious or does not have a verified company.
9. Optional: Run the rootkit scanner.
10. Let a top virus scanner remove any files that were left.
11. Optional: Run anti-malware and anti-spyware scanners to get rid of junk.
12. Optional: Run tools like HijackThis/OTL/ComboFix to get rid of junk.
13. Reboot and enjoy your clean system.
14. Optional: Run the rootkit scanner again.
15. Make sure your computer is sufficiently protected!

Some remarks:

• Autoruns is written by Microsoft and thus shows any locations of things that automatically start...
• Once software is unchecked from Autoruns, it will not start and can't prevent you from removing it...
• There do not exist rootkits for 64-bit operating systems because they would need to be signed...

It is effective because it will disable malware/spyware/viruses from starting,
you are free to run optional tools to clean out any junk that was left on your system.

Answer 6

If you notice any of the symptoms then one thing to check is the DNS settings on your network connection.

If these have been changed either from "Obtain DNS server address automatically" or to a different server from the one it should be, then that's a good sign that you have an infection. This will be the cause of the redirects away from anti-malware sites, or a complete failure to reach the site at all.

It's probably a good idea to take a note of your DNS settings before an infection occurs so you know what they should be. Also the details will be available on the help pages of your ISP's web site.

While resetting the DNS won't fix the problem it will allow you to a) reach the anti-malware sites to get the software you need to clean the PC and b) spot if the infection recurs as the DNS settings will change again.

Answer 7

Another tool I would like to add to the discussion is the Microsoft Safety Scanner. It was just released a few months ago. It is a bit like the Malicious Software Removal Tool, but designed for offline use. It will have the latest definitions as of the moment you download it and will only be useable for 10 days as it will consider its definitions file "too old to use". Download it with another computer and run this in safe mode. It works pretty well.

Answer 8

There is a wide variety of malware. Some of it is trivial to find and remove. Some of it is trickier. Some of it is really difficult to find, and very hard to remove.

But even if you have a mild malware you should strongly consider reformating and reinstalling the OS. This is because your security has already failed, and if it failed for a simple malware maybe you're already infected with a vicious malware.

People working with sensitive data or inside networks where sensitive data is held should strongly consider wipe and re-install. People whose time is valuable should strongly consider wipe and re-install (it's quickest and easiest and surest method). People who are not comfortable with advanced tools should strongly consider wipe and re-install.

But people who have the time, and enjoy noodling around, can try methods listed in other posts.

Answer 9

Step one: check bank account activity, change bank & email passwords, notify banks if any unusual activity (individuals have 10 days, businesses only 2 (but I think only the first $100,000 is insured).