Comments on: How To Remove Computer Viruses At Home For Free

By: Mehter

Mehter — Tue, 04 May 2010 14:29:00 +0000

thanks for share. good writing.

By: Computer Repair Geek

Computer Repair Geek — Mon, 03 May 2010 22:13:19 +0000

I think Avira free edition will resolve your issues. If that does not work you can always call Geeks in Minutes

By: Ollie

Ollie — Sat, 01 May 2010 05:11:26 +0000

Why do you uninstall the program after you've scanned it? So does that mean every time I do a scan, I need to run the installer over again just to scan, and the uninstall it? Why not keep all the programs installed?

Thank you

By: Ollie

Ollie — Sat, 01 May 2010 05:11:00 +0000

Why do you uninstall the program after you’ve scanned it? So does that mean every time I do a scan, I need to run the installer over again just to scan, and the uninstall it? Why not keep all the programs installed?

Thank you

By: biber hapÄ±

biber hapÄ± — Thu, 22 Apr 2010 23:01:33 +0000

Good to have bumped onto your blog and met you.

By: Aibek

Aibek — Thu, 22 Apr 2010 06:43:00 +0000

thank you GMan! some really nice tips here.

Aibek

By: Aibek

Aibek — Thu, 22 Apr 2010 06:43:00 +0000

thank you GMan! some really nice tips here.

Aibek

By: GMan

GMan — Wed, 21 Apr 2010 20:33:26 +0000

Forgot to mention.
If you are a noob (although I use it too), you can just get the AVG LinkScanner component which you can use in tandem with your AV if it doesn't do it.
The following 3 tips will most likely prevent you from ever getting infected in the first place:

1) Use Firefox with NoScript, training NoScript as you go, combined with AVG LinkScanner (or similar).

2) If you download a file from the internet (email/torrent/website/whatever) scan it BEFORE running it, ALWAYS. Microsoft provide free AV now, so there's no excuse! Or you can use the online scanners (jotti for example)

3) If you're not expecting a parcel from UPS or you don't bank with Barclays, don't even touch emails reporting to be from them. Better still, turn off HTML in your email client. If you must follow a link in an email, check the REAL destination in the status bar first, or preferably, manually go to the website and log in with your credentials to see if the email is confirmed there.

4) OK, I said 3. Never run as an administrator and make sure UAC is on.

By: GMan

GMan — Wed, 21 Apr 2010 20:33:00 +0000

Forgot to mention.
If you are a noob (although I use it too), you can just get the AVG LinkScanner component which you can use in tandem with your AV if it doesn’t do it.
The following 3 tips will most likely prevent you from ever getting infected in the first place:

1) Use Firefox with NoScript, training NoScript as you go, combined with AVG LinkScanner (or similar).

2) If you download a file from the internet (email/torrent/website/whatever) scan it BEFORE running it, ALWAYS. Microsoft provide free AV now, so there’s no excuse! Or you can use the online scanners (jotti for example)

3) If you’re not expecting a parcel from UPS or you don’t bank with Barclays, don’t even touch emails reporting to be from them. Better still, turn off HTML in your email client. If you must follow a link in an email, check the REAL destination in the status bar first, or preferably, manually go to the website and log in with your credentials to see if the email is confirmed there.

4) OK, I said 3. Never run as an administrator and make sure UAC is on.

By: GMan

GMan — Wed, 21 Apr 2010 20:23:34 +0000

One of the first things I do is check the System32 (make sure show system and hidden files etc is on) folder, sorted by date, for recent files with suspicious names (E.G. 7fcx5evd.dll). If you hover over files your'e not sure about, it will tell you the name of the publisher more often than not. If found, delete all temporary files (userprofile\local settings\temporary internet files windows\temp etc, as this is where most of the cruft related to these dodgy DLLs hide.
If it's badly infected at this point, I might bother with a System Restore to try and undo some of the changes.
Then reboot in safe mode.
Open Regedit and browse to the 'Run' key in both HKLM and HKCU and remove any suspect entries.
Download MBAM, renaming the installer as it is saved to the computer.
Run the renamed installer and then download the random filename generated executable from the MBAM site. UPDATE MBAM!
Let it do a full scan and remove anything it finds.
Sometimes system files and associations get corrupted. sfc /scannow, should fix original windows files and following advice at dougknox DOT com will restore the correct file associations.
Keep an eye on the System32 folder as above and make sure any suspect DLLs are gone.
SpywareBlaster is excellent as mentioned earlier.
Use Firefox with NoScript if you are a noob :) and never, NEVER accept gifts from the internet! DON'T disable UAC even though your hip friends recommend doing so.
BleepingComputer is also great for stubborn malware advice, although if it is that stubborn, I often think a rebuild is better, especially if it's a noob/parents PC.
Messy braindump, sorry. Hope it helps

By: GMan

GMan — Wed, 21 Apr 2010 20:23:00 +0000

One of the first things I do is check the System32 (make sure show system and hidden files etc is on) folder, sorted by date, for recent files with suspicious names (E.G. 7fcx5evd.dll). If you hover over files your’e not sure about, it will tell you the name of the publisher more often than not. If found, delete all temporary files (userprofilelocal settingstemporary internet files windowstemp etc, as this is where most of the cruft related to these dodgy DLLs hide.
If it’s badly infected at this point, I might bother with a System Restore to try and undo some of the changes.
Then reboot in safe mode.
Open Regedit and browse to the ‘Run’ key in both HKLM and HKCU and remove any suspect entries.
Download MBAM, renaming the installer as it is saved to the computer.
Run the renamed installer and then download the random filename generated executable from the MBAM site. UPDATE MBAM!
Let it do a full scan and remove anything it finds.
Sometimes system files and associations get corrupted. sfc /scannow, should fix original windows files and following advice at dougknox DOT com will restore the correct file associations.
Keep an eye on the System32 folder as above and make sure any suspect DLLs are gone.
SpywareBlaster is excellent as mentioned earlier.
Use Firefox with NoScript if you are a noob :) and never, NEVER accept gifts from the internet! DON’T disable UAC even though your hip friends recommend doing so.
BleepingComputer is also great for stubborn malware advice, although if it is that stubborn, I often think a rebuild is better, especially if it’s a noob/parents PC.
Messy braindump, sorry. Hope it helps

By: tommedeiros

tommedeiros — Tue, 20 Apr 2010 16:44:49 +0000

Interesting that you would recommend spending what amount to hours of your free time "attempting" to save a couple hundred bucks having a professional do it.

One caveat to the above procedure: Most new wave rougue trojans that mask as fake antivirus software are resilent and if not removed properly, will reinfect your system. Most of these originate from third world and eastern european nations with the intent of stealing your identity, so its very important to remove them as soon and as effectively as possible, before accessing any sites that require login and passwords.

By: Anonymous

Anonymous — Tue, 20 Apr 2010 16:44:00 +0000

Interesting that you would recommend spending what amount to hours of your free time “attempting” to save a couple hundred bucks having a professional do it.

One caveat to the above procedure: Most new wave rougue trojans that mask as fake antivirus software are resilent and if not removed properly, will reinfect your system. Most of these originate from third world and eastern european nations with the intent of stealing your identity, so its very important to remove them as soon and as effectively as possible, before accessing any sites that require login and passwords.

By: bruno

bruno — Mon, 19 Apr 2010 16:12:00 +0000

All of these methods count on AV software detecting malware which often fails to detect the hard ones (mostly rootkits). When AV fails, I suggest asking for help at bleeping computer or other malware removal forum. Or if you are (or know somebody) skilled with tools like RootRepeal, DDS, Combofix etc. you can clean the malware much more effectively without hours of scanning.

By: Leon

Leon — Mon, 19 Apr 2010 11:02:00 +0000

Online armour is effective at helping you monitor what is happening on the machine. Puppy Linux is useful for backing up data. Malwarebytes is great too. Thanks for interesting article and comments!