Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Possible Duplicate:
Computer is infected by a virus or a malware, what do I do now?

I got infected by a virus. It looks like I removed it, but it somehow injected a few more processes (I can see them in the task manager) that respawn when I kill them (somehow). Is there a way to destroy those process to stop them from respawning, or in the case something else is respawning them, to kill that "something"?

I really don't want to format my pc for this. The data in it is very important for me (personal value) so I'd really want to know a way to do this without reinstalling my OS.

I'm on Windows Vista 32 bits.

share|improve this question

marked as duplicate by Bob, Ivo Flipse Jun 12 '12 at 8:13

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
in the future, please don't crosspost; if your question posted to Stack Overflow is more appropriate to Super User or Server Fault, it will be migrated by the community. –  quack quixote May 3 '10 at 17:03
    
take this 'infection' as a good point to 'backup' that irreplacable data to something else (2ndary hard drive / remote backup / network storage). After being infected, the best method to get rid of this virus is to re-format (only way to be 100% sure). Depending on the virus you may have critical system services affected. –  Jakub May 3 '10 at 17:23

3 Answers 3

up vote 6 down vote accepted

Reformat your computer. Anything more is a waste of effort.

share|improve this answer
    
there might be valuable data on that computer. it's not so hard to remove a virus without reformatting everything. –  ax. May 3 '10 at 16:40
3  
@ax - Only a fool would keep valuable data in one place. –  ChaosPandion May 3 '10 at 16:42
    
@ax: It is that hard to know you've removed the virus. Copying off the important and irreplaceable data and nuking and rebuilding the system isn't that much work, mostly, and is more reliable. –  David Thornley May 3 '10 at 16:42
    
+1: Reformatting is the best option, as far as security and efficiency go. You can't ever be sure of a machine after its been infected. I work for a big corporation, and we re-image infected machines whenever we find them. We have a godawful huge amount of expensive antivirus software, and we STILL do it that way. –  Satanicpuppy May 3 '10 at 19:31

Reformatting is the easiest sure-fire way of removing the virus, although the most time consuming.

You can also do a couple of things that require less time and effort. You can run 'msconfig' from the start menu and remove any unknown processes from the Startup tab in the dialog. You can also restart your computer in Safe Mode and run 'regedit', then look for any unknown entities in your registry. Make sure, though, with either of these methods that you know what process or registry item you are removing or stopping. You can Google the name of whatever you are modifying and it will usually return results telling you if the item is safe or if it is a virus.

Here is a site with some info about where viruses are usually hiding: Where do Viruses Hide

share|improve this answer

The most secure way to get rid of a virus is to reinstall your OS. If you have valuable data on your computer, you should back it up first, preferably while booting from some recovery CD (an Ubuntu live CD will suffice). A good practice is to have 2 partitions on your hard disk, one for the system and program files, and another for data files, so if you need to reinstall your system, you don't have to back up your films, music and other 100 GBs of data.

Removing a virus without reinstalling can be tricky. You should have a way to manage startup programs (Windows donesn't have a good program for this, though you can use regedit if you know how to use it). I use a Total Commander plugin for this purpose. You should also have an alternate task manager and registry editor, because some viruses block them (I also use TC plugins for that). There are also some useful tools that kill any processes that use a certain file and then deleting the file, so you can delete those programs that respawn themselves (Unlocker is one, for example).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.