Remove viruses from an infected PC, and keep them from coming back
Our family PC gets quite a workout. It's a five-year-old machine that runs Windows XP and is used primarily by my daughter and teenage grandson for instant messaging, e-mail, social networking, and downloading audio and video files. Since I rarely use the system, I didn't notice that its antivirus subscription had expired.
Which explains why I was a bit surprised when my grandson called when I was out of town to tell me that the PC was acting strangely. Ads appeared on the desktop as soon as Windows started and Firefox and other programs would occasionally close without warning or fail to open at all.
I immediately suspected a virus and instructed my grandson to perform a virus scan. Unfortunately, the machine's antivirus app had gone AWOL. I talked him through the process of using System Restore to revert the PC to an earlier time. This improved matters somewhat, but the system continued to act flaky.
When I returned from the trip, I started the troublesome machine and attempted to open the Microsoft Update site to make sure its copy of XP was up-to-date. But the malware had managed to disable several Windows services intermittently, including Services.msc, so Internet Explorer would shut down repeatedly.
At this point, I was seriously considering a hard-disk reformat and XP reinstall. I even had the XP installation CD in the drive and was ready to begin the process. But even though my daughter and grandson assured me that they had backup copies of all their personal files, I decided to try one more time to salvage the existing setup.
I'm very glad I did, because it turns out there were lots of vacation and holiday images and videos on the machine that hadn't been backed up. First, I installed a free copy of Malwarebytes' Anti-Malware antivirus program on the infected PC, updated the app's virus definitions, and ran a complete scan.
The initial Malwarebytes Anti-Malware scan detected 104 separate infected files and folders.
(Credit: Malwarebytes)That first scan turned up a mere 104 infected files and folders. Here's a list of the nasties the machine had picked up:
• Trojan.Vundo
• Troja.Vundo.H
• Trojan.FakeAlert
• Rogue.Installer
• Trojan.Downloader
• Trojan. Dropper
• Trojan.Agent
• Worm.KoobFace
• Rogue.AdvancedVirusRemover
• Rogue.SystemSecurity
• Adware.BHO
• Rootkit.Agent
• Spyware.Agent
• Trojan.BHO
• Hijack.LSP
• Rogue.Multiple
• Disabled.Security
After viewing the report, I rebooted the PC and ran another malware scan. This time, Malwarebytes' app found only nine infected files.
The second Malwarebytes Anti-Malware scan detected only nine infected items.
(Credit: Malwarebytes)I rebooted once more and ran yet another scan, which indicated that the PC came up clean.
The third Malwarebytes Anti-Malware scan indicated that all viruses and other malware had been removed from the infected PC.
(Credit: Malwarebytes)Once I was assured that the PC was malware-free, I revisited the Microsoft Update site to download and install all the XP security patches the machine required. Then I sprang for the $25 version of Anti-Malware to get the program's real-time virus scanning and automatic updates.
I knew all attempts to alter the user behavior that led to the infections would be futile, so instead, I instructed my daughter and grandson to run Malwarebyte's scanner each time they start the system and just before each shutdown. That was a little over two weeks ago, and so far, the PC remains free of infection. Still, you can bet I'll be paying much closer attention to that machine from now on.
Dennis O'Reilly has covered PCs and other technologies in print and online since 1985. Along with more than a decade as editor for Ziff-Davis's Computer Select, Dennis edited PC World's award-winning Here's How section for more than seven years. He is a member of the CNET blog Network, and is not an employee of CNET. 
Thanks,
Dennis
If you can't change user behaviour, change the system's behaviour. You should seriously consider creating a standard (non-priviledged) user account for use by the youngsters and only use the (password-secured) administrator account e.g. when you have to install a program or change system settings. They might still catch something, but at least it won't affect the entire computer. It's not much good running around the house and looking for burglars if there are no locks on your doors.
"It's a five-year-old machine that runs Windows XP and is used primarily by my daughter and teenage grandson for instant messaging, e-mail, social networking, and downloading audio and video files."
For that kind of use, you may be better off installing any modern-day Linux distro (e.g. Ubuntu) and disabling sudo (root access) for the kids. They will have to try really hard to get that system infected.
Thanks,
Dennis
"Then I sprang for the $25 version of Anti-Malware to get the program's real-time virus scanning "
Malwarebytes doesn't have Anti virus capabilities.Also it is surprising Denis didn't mention any Scans with any regular antivirus *** antivirus Programs.
This story appears to mislead novice computer users that Malwarebytes can replace a regular Antivirus/anti malware Apps.
Thanks,
Dennis
Denis, as you are no doubt a very experienced PC user, I find a lot of what you have written here to be surprisingly inaccurate. First of all, a system restore is the last thing you want to be doing when a machine is heavily infected. Second up, just because MBAM says the machine is clean doesn't necessarily mean it is so. MBAM is an excellent product but even the best security software cannot identify 100% of malware all the time. You would need to run scans through multiple engines and even then there are no guarantees.
Your biggest error is the lack of any mention of anti virus software for the kids machine. MBAM, even with real time protection in the commercial version, is not a fully fledged anti virus and is a poor substitute for one. MBAM should be used in conjunction with anti vrius software not instead of it!!
Good read though....LOL. I am grandad (Pop) to 12 so I can definitely relate.
cheers....Jim
Thanks,
Dennis
it even listed my errorfix prog!! and a few other apps I use, including a spyware app . decided not to purchase and stick with spyware detector.
As other has mentioned you should try scan your PC with different anti-virus software (not at the same time!) and perform the scans in safe mode with networking, also clean up your junk files and temp folders.I Never use system restore if it is malware related, that can bring the nasty back and even corrupt your registry. After seeing what the MBAM log file shows check for any rootkits and run Hijackthis. Some virus are really good at hiding and can only be knocked off manually. Use programs that shows the directory of the malware, after you clean it up and reboot go to the directory and make sure it is gone. Never let children or "friends" use the Admin accounts, I learn that the hard way. I hope my advice is helpful, if there is anything missed out on let me know guys :) take care.
~Edgardo
Thanks,
Dennis
It is important to have multiple defense mechanisms:
Firewall - in today's world actually two hardware and software versions. Devices provided by high speed ISPs usually have firewall built in.
Antivirus - I'd also go with two.
Malware/Spyware detection and removal - also two
The reason to have more than one program doing the same thing is that different vendors implement their apps differently. Having two programs doing same helps in case when one doesn't catch a problem the other hopefully would because the logic behind each application is different.
I also ran CCleaner and Advanced System Care (free version, just don't want to spend $30 for just a couple of features). That keeps my hard drive clutter free.
Dennis did exactly the right first-form steps on cleaning a computer though. Most infections that occur are of the spyware and trojan types. That being said, typically when a machine is as infected as he describes, the first priority is to get the computer into some semblance of usability. Usability in this case would be stopping pop ups and restoring as much of the normal system functions as possible. Once you've eliminated the threats that keep you from doing normal work (like launching applications, etc...) then it's time for deep scanning the system.
While the title may be a bit misleading if you consider a virus as something other than malware (which would be incorrect as generally any virus is unwanted). The article itself doesn't state not to run antivirus, it was a depiction of how Dennis got a computer back in to normal working mode using a specific program. A typical user can usually download one of every flavor of antivirus and anti-spyware and anti-malware software and run them each one at a time and still have each and every one of them find problems and still not have a clean PC afterwards. Welcome to the world we live in.
Let's all go back to the day when trolls just flamed user comments for no reason instead of the author.
Lately I have been depending on mainly Security360 deep scans which has found dozens of tracking cookies and several virus-installers. MBAM at its first implentation found 3 threats (virus installers) , but since keeps telling me my system is clean (...which according to Security360, it definitely is NOT).
Currently I scan almost daily (over-night) with Security360, and once a or twice a week with MBAM. (to supplement main my anti-virus LiveCare, which is auto daily)
My internet browser activity is quite conservative lately as my knowledge of threats on-line increases I realize NO MATTER WHAT A-V or MalWare product you use, they will not prevent 100% the totality of the threats out there. There this awareness and resulting paranoia is limiting my choice of surfing risk.
Despite limiting my on-line activities to a 'low-risk' sites, this morning (Sept 14) IObit Security360 came up positive with 19 threats (18 TrackingCookies, and a Trojan.Agent). The Trojan.Agent was downloaded on Aug 31 via a download of e2eSoft 'VCam and VAudio (same bundle), so it took Security360 more than 2 weeks itself to find this trojan. AND, I still have NO IDEA what program the trojan 'dropped' on my drive.
My Vista Premium is kept up-to-date, as are my AV,and supplemental 'malware' and maintenance programmes. I scan and clean daily, yet I know there are bugs and likely viruses, malware that still remain because of slowness, crashes caused by DEP and COM Surrogate when using IE and opening AVI and media files, and COM Surrogate trying to access the internet.
All we can do is minimize, the criminals and ******-bags that are responsible. They and their malware/viruses are similar to the spiders and cockroaches all around us in our walls and under the floors. You may scrunch a few of them you see out in the open, BUT there is no way for the foreseeable future to find and kill them all.
On top of that, most anti virus programs only very limitedly recognise something called 'droppers'. These are initiators of virusses that come in so many different forms that scanning for them is near impossible. Having one of these on your machine will guarantee the return of a virus, despite it being found 'clean'. Good Anti-virus software will detect its launch, but can do nothing to prevent it from happening again.
The advice to given in this article is not good advice. SBAM is not a substitute for an antivirus program, and the right thing to do for this machine is to format and reinstall it. Surely taking of the photo's is not a problem....
- by pandacake September 16, 2009 5:12 PM PDT
- so do i have to back up my files before using this? can i use still even if im using avira??? please helpp D:
- Like this Reply to this comment
-
(30 Comments)