Malware Removal Guide for Windows

[geohac]

I have made a step by step guide on how to remove malware from a computer. I would like to know what you think about it. I will be updating it as I go on. I would greatly appreciate any info on how to make it better.

Malware Removal Guide for Windows

[Overmann]

Delicious guide, let's see what the experts say.

[torres-no-tan-magnifico]

Had a quick glance at your site and I am certain it will prove very useful for PC users of all abilities.

I noticed that the Remove Malware page has a different background colour than the rest of the site- either make all the pages this colour or change it to the lighter one for consistency.

The PNG titles for both the Home page and Forum have far too much drop shadow on the font and therefore, make them look fuzzy and harder to read- the exact opposite of what you are trying to achieve.

These are just my initial thoughts, so please don't take them too harshly.

Anyway, well done for getting a website up and running!

[Anupam]

I will call it a good attempt, but still not adequate. Malware removal might not be such an easy process. For a mild infection, it would work though. Still, I found some deficiencies in above. I am by no means an expert, but still giving opinion by whatever I know.

Turning off the system restore should be done at the beginning, and not at the end. Reason is, malware tend to hide there, and can become active, even after your whole system has been cleaned. It can bring things back to square one. So, first thing in case of an infection should be to turn off system restore, and then scan the computer. It will also decrease the scan times.

As written, I found the uninstallation of antivirus before scanning, quite odd. If its a mediocre antivirus, then this advice might be good. But, what if the antivirus installed was Avira itself, or any other good antivirus like Avast, or Kaspersky? If that's the case, you are not making very good point when you uninstall Avira first, and then install it later again. Even if malware has got past the antivirus, still, the antivirus should be kept installed, because it can help in prevention of further infection, and can help in containing the malware. In some cases, the infection might prevent the re-installation of an antivirus.

If this guide is targeted at inexperienced users, then I wouldn't recommend the use of CCleaner Registry Cleaner mentioned later on. Although, its registry cleaner is considered very safe, still, a registry cleaner in the hands of novices is not good. It can create problems. That part can be left out. If the malware has been removed by an efficient malware remover, it would handle the registries installed by the malware too.

There might be case of infection, where exe files can get infected, or any antivirus won't be able to install, or the computer cannot boot into Safe Mode. For that cases, I think you should mention antivirus rescue CDs like Kaspersky, or Avira.

Malware removal is not an easy process to attempt, and there might be involved a myriad of steps depending on the severity of the infection.

[Sope]

Originally Posted by Anupam

As written, I found the uninstallation of antivirus before scanning, quite odd. If its a mediocre antivirus, then this advice might be good. But, what if the antivirus installed was Avira itself, or any other good antivirus like Avast, or Kaspersky? If that's the case, you are not making very good point when you uninstall Avira first, and then install it later again. Even if malware has got past the antivirus, still, the antivirus should be kept installed, because it can help in prevention of further infection, and can help in containing the malware. In some cases, the infection might prevent the re-installation of an antivirus.

I feel the same regarding this point. The installed AV may well be a perfectly good product, just that it has missed a zero day malware. No AV is perfect after all. Bad practice on behalf of the user may be a more significant factor in causing the infection. The PC owner may also have paid good money for a year subscription with plenty of time left to run. They may be better off discussing it with the developer than just dumping it straight away.

You've made a good start though (IMHO) and no doubt you intend to tweak the guide as time goes on.
Nice job

[MidnightCowboy]

Good effort and a lot of useful resources linked to if only folks would take the trouble to read some of them

[geohac]

Torresmagnifico, thanks for the suggestions! I will get on those issues as soon as I can.

Turning off the system restore should be done at the beginning, and not at the end. Reason is, malware tend to hide there, and can become active, even after your whole system has been cleaned. It can bring things back to square one. So, first thing in case of an infection should be to turn off system restore, and then scan the computer. It will also decrease the scan times.

Anupam, you are right about System Restore. I've changed it!

Even if malware has got past the antivirus, still, the antivirus should be kept installed, because it can help in prevention of further infection, and can help in containing the malware.

You make a good point, but you are not completely correct. I have added the option to disable the anti-virus, so users can choose to uninstall or disable it.

If this guide is targeted at inexperienced users, then I wouldn't recommend the use of CCleaner Registry Cleaner mentioned later on. Although, its registry cleaner is considered very safe, still, a registry cleaner in the hands of novices is not good. It can create problems.

CCleaner’s registry cleaner is very safe. I have not experienced any problems or side effects with it, nor have I heard of any.

There might be case of infection, where exe files can get infected, or any antivirus won't be able to install, or the computer cannot boot into Safe Mode. For that cases, I think you should mention antivirus rescue CDs like Kaspersky, or Avira.

That’s a great idea! I will add that as soon as I can.


Thanks for all the suggestions everyone. Keep them coming!

[geohac]

Anupam, I have moved the step of disabling system restore after the removal process rather than before. I think it's safer that way.

[ako]

Originally Posted by geohac

I have made a step by step guide on how to remove malware from a computer. I would like to know what you think about it. I will be updating it as I go on. I would greatly appreciate any info on how to make it better.

Malware Removal Guide for Windows

For some easy infections this looks quite OK. For more stubborn ones you might like to peek this

http://www.techsupportalert.com/cont...ld.htm#cleanup

I know, easier to reformat

[Anupam]

Originally Posted by geohac

Anupam, I have moved the step of disabling system restore after the removal process rather than before. I think it's safer that way.

How is it safer that way? If a malware infection has occurred, there are a lot of chances that the infection must have got through to the system restore files too, and it may elude the security software.

I see in Ako's guide too, that the system restore was emptied later on towards the end.

Ako, shed some light on this?

I feel that since a stubborn malware infection has occurred, it will be spread to system restore too. So, why not empty it early on, and then scan the computer? Even if you want the system restore as a backup, but still, the files there are infected, and restoring them would get the system infected again.

One argument in your case might be that we can try scanning the computer and see if the infection is removed from the system restore too, and so, the restore points would still be safe, and good. In that case, its good. But, how can you be 100% sure, that the scan has cleared all the infection there, and the infection wont reappear.

The system restore is being emptied at the end of the removal steps anyway. So, why not do it earlier?

geohac, I still find it odd that you say to remove or disable the AV before starting the removal process. Even if the AV missed the malware, I think it should still be given the chance to boot into safe mode, and then scan the PC once again, after updating the definitions. Maybe, it will be able to deal with the infection in the safe mode. Just disabling, or removing the AV before the removal process without giving it a chance is really odd to me. It would be more odd, if the AV was top class like Avira, or Kaspersky, or Avast etc.