112 - Virus/RootKit/Ransomware Removal and CleanUp
If the usual AV programs don't work (in Windows Safe Mode), try booting from a USB drive.
On an uninfected PC - partition and format a USB Flash drive using RMPrepUSB (this cleans the drive of any virus that might already be on the flash drive)
The following programs can be downloaded on an uninfected computer and copied to a USB Flash drive.
Then connect the flash drive to the infected computer and boot from it to run the program. If you have a Windows 8 system, you may need to change the BIOS settings to enable BIOS Legacy or CSM Boot mode (not pure UEFI Mode).
WARNING: Ransomware is becoming very prevalent and there are now many decryption programs available. See here and here and here.
This type of malware encrypts your documents and files and then they demand a 'ransom' payment to decrypt it for you. It is important to realise that even if you have synchronised online Cloud Storage folders, these will also get encrypted! Therefore synchronising your documents to the 'Cloud' (e.g. DropBox) does not protect you from Ransomware. PLEASE MAKE SURE YOU HAVE A CURRENT BACKUP OF ALL YOUR IMPORTANT FILES IN OFF-LINE STORAGE - for instance use a 1TB USB 3.0 portable hard drive which you keep in a locked drawer. Set a date in your calendar to make a regular backup onto this drive.
Note: Dropbox keeps previous versions, so you may be able to recover a previous unencrypted version of you files.
Tip: Try the free Norton Power Eraser. If used in conjunction with the Norton Bootable Recovery Tool (not free) it can remove CryptoLocker/Ransomeware. Also try HitmanPro (see below).
For an independent evaluation of the various AV products available - see here. For test reports see here.
Run the program on the target system in safe mode and select the full, deep-scan option
Go and get a cup of tea - it could take a while!
Follow the instructions here (or see Tutorial 119 for a way to add it to a multiboot (E2B) USB Removable Flash drive. Note: an internet connection is required when you use HitManPro, so the infected system must be connected to the internet.
Other bootable AV LiveCD ISOs
It is better to boot from a clean USB drive to a linux or WinPE-based recovery solution (LiveCD) than try to run a program from the infected Windows system itself.
Create an Easy2Boot USB drive and download and drag-and-drop these various AntiVirus ISO files to the E2B USB drive's \_ISO\ANTIVIRUS folder. Details on how to make an E2B multiboot USB drive can be found on the E2B Tutorial 72a.
6. Use Windows Control Panel - Programs - Uninstall programs and uninstall any programs you have never used
7. Uninstall all AV programs except one AV program (e.g. Avast free)
8. Run the AV (if using Avast do a 'Boot-time scan' and check for 'potentially unwanted programs' (PUPs).
9. Run MSConfig and disable all unneeded Startup items (if in doubt disable them all except the AV program and then enable any that you find you really need after rebooting!)
10. In MSConfig - Services - deselect any unwanted, resource hungry services - e.g. Fax, update services, parental controls, Media Centre stuff, Windows Search (use SwiftSearch instead!)
11. For best performance, change the Windows performance settings ((Right-click on Desktop - Personalize) Windows 7 Classic (or Basic which uses slightly more resources)
12. Right-click on Computer icon and go to Advanced System Settings - Performance Options - Adjust for best performance - Apply. You can also disable System Restore (protection) - remember to make a restore point manually once you have a 'stable' system.
13. Tweak AV settings exclude some searched folders from a scan to improve performance (e.g. if you keep loads of files in D:\MyVideos and you never download files into that folder then you can exclude it from the AV search scans).
14. Browser - Reset (e.g. Delete Personal Settings in IE) to clear all old settings and passwords, etc. - then in your browser settings, 'Manage your search engines' and delete all but one (e.g. leave Google). Avoid 'Ask' and 'Delta Search'!
15, Run CCleaner again and Windows Disk Cleanup
16. Defrag your hard drives (Windows defrag or Defraggler)