If the usual AV programs don't work (in Windows Safe Mode), try booting from a USB drive. On an uninfected PC - partition and format a USB Flash drive using RMPrepUSB (this cleans the drive of any virus that might already be on the flash drive) The following programs can be downloaded on an uninfected computer and copied to a USB Flash drive. Then connect the flash drive to the infected computer and boot from it to run the program. If you have a Windows 8 system, you may need to change the BIOS settings to enable BIOS Legacy or CSM Boot mode (not pure UEFI Mode).
WARNING: Ransomware is becoming very prevalent and there are now many decryption programs available. See here and here and here.
This type of malware encrypts your documents and files and then they demand a 'ransom' payment to decrypt it for you. It is important to realise that even if you have synchronised online Cloud Storage folders, these will also get encrypted! Therefore synchronising your documents to the 'Cloud' (e.g. DropBox) does not protect you from Ransomware. PLEASE MAKE SURE YOU HAVE A CURRENT BACKUP OF ALL YOUR IMPORTANT FILES IN OFF-LINE STORAGE - for instance use a 1TB USB 3.0 portable hard drive which you keep in a locked drawer. Set a date in your calendar to make a regular backup onto this drive.
Note: Dropbox keeps previous versions, so you may be able to recover a previous unencrypted version of you files.
Tip: Try the free Norton Power Eraser. If used in conjunction with the Norton Bootable Recovery Tool (not free) it can remove CryptoLocker/Ransomeware. Also try HitmanPro (see below).
For an independent evaluation of the various AV products available - see here. For test reports see here.
Rootkit disinfectionKaspersky TDSSKiller (time=5 minutes)
MBAR - Malwarebytes Anti-Malware (time=2-5 hours)
HitmanPro.Kickstart (anti-ransomware)
Follow the instructions here (or see Tutorial 119 for a way to add it to a multiboot (E2B) USB Removable Flash drive. Note: an internet connection is required when you use HitManPro, so the infected system must be connected to the internet.
Other bootable AV LiveCD ISOsIt is better to boot from a clean USB drive to a linux or WinPE-based recovery solution (LiveCD) than try to run a program from the infected Windows system itself.
Create an Easy2Boot USB drive and download and drag-and-drop these various AntiVirus ISO files to the E2B USB drive's \_ISO\ANTIVIRUS folder. Details on how to make an E2B multiboot USB drive can be found on the E2B Tutorial 72a.
Note: If using Easy2Boot, many of these can be added with persistent updates. Check this page for a link for each one and how to add persistence.
AV programs to run from within the OS (e.g. Windows Safe Mode)Suggested order for disinfecting and speeding up your systemKeep a download of the following programs on your USB stick and carry it with you everywhere so you can 'rescue' an infected PC. Install them and run them to clean up the PC and improve performance:
1. CCleaner
2. MalwareBytes Anti-Malware
3. MalwareBytes Anti-Rootkit (mbar)
4. MalwareBytes Anti-Exploit BETA
5. AdwCleaner (www.bleepingcomputer.com)
6. Use Windows Control Panel - Programs - Uninstall programs and uninstall any programs you have never used
7. Uninstall all AV programs except one AV program (e.g. Avast free)
8. Run the AV (if using Avast do a 'Boot-time scan' and check for 'potentially unwanted programs' (PUPs).
9. Run MSConfig and disable all unneeded Startup items (if in doubt disable them all except the AV program and then enable any that you find you really need after rebooting!)
10. In MSConfig - Services - deselect any unwanted, resource hungry services - e.g. Fax, update services, parental controls, Media Centre stuff, Windows Search (use SwiftSearch instead!)
11. For best performance, change the Windows performance settings ((Right-click on Desktop - Personalize) Windows 7 Classic (or Basic which uses slightly more resources)
12. Right-click on Computer icon and go to Advanced System Settings - Performance Options - Adjust for best performance - Apply.
You can also disable System Restore (protection) - remember to make a restore point manually once you have a 'stable' system. 13. Tweak AV settings exclude some searched folders from a scan to improve performance (e.g. if you keep loads of files in D:\MyVideos and you never download files into that folder then you can exclude it from the AV search scans).
14. Browser - Reset (e.g. Delete Personal Settings in IE) to clear all old settings and passwords, etc. - then in your browser settings, 'Manage your search engines' and delete all but one (e.g. leave Google). Avoid 'Ask' and 'Delta Search'!
15, Run CCleaner again and Windows Disk Cleanup
16. Defrag your hard drives (Windows defrag or Defraggler)
Other Installable Windows AV programs
Microsoft Security Essentials (free and doesn't slow the system down too much)
Kasperksy AV (CD On Demand - retail version - special price!)
Kasperksy PURE (CD on Demand - retail version - special price!) - click here for MAC version
Dr Web CureIt http://www.freedrweb.com/cureit/
EmisSoft Anti-Malware Emergency Kit http://www.emsisoft.com/en/software/antimalware/
Malware Bytes http://www.malwarebytes.org/
Bit Defender AV Plus http://www.bitdefender.co.uk/Downloads/
Trend Micro http://www.trendmicro.ae/downloads/index.html
McAfee AV Plus http://home.mcafee.com/store/free-antivirus-trials
Sophos http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx http://www.sophos.com/en-us/products/endpoint-antivirus.aspx
AhnLab AV and Removal Tools http://global.ahnlab.com/en/site/download/downloadMain.do
Ask for help!http://www.daniweb.com/hardware-and-software/microsoft-windows/viruses-spyware-and-other-nasties/64http://support.kaspersky.com/5350?el=88446#block1 |
