112 - Virus/RootKit/Ransomware Removal and CleanUp
On an uninfected PC - partition and format a USB Flash drive using RMPrepUSB (this cleans the drive of any virus that might already be on the flash drive)
The following programs can be downloaded on an uninfected computer and copied to a USB Flash drive.
Then connect the flash drive to the infected computer and boot from it to run the program. If you have a Windows 8 system, you may need to change the BIOS settings to enable BIOS Legacy or CSM Boot mode (not pure UEFI Mode).
This type of malware encrypts your documents and files and then they demand a 'ransom' payment to decrypt it for you. It is important to realise that even if you have synchronised online Cloud Storage folders, these will also get encrypted! Therefore synchronising your documents to the 'Cloud' (e.g. DropBox) does not protect you from Ransomware. PLEASE MAKE SURE YOU HAVE A CURRENT BACKUP OF ALL YOUR IMPORTANT FILES IN OFF-LINE STORAGE - for instance use a 1TB USB 3.0 portable hard drive which you keep in a locked drawer. Set a date in your calendar to make a regular backup onto this drive.
Note: Dropbox keeps previous versions, so you may be able to recover a previous unencrypted version of you files.
Tip: Try the free Norton Power Eraser. If used in conjunction with the Norton Bootable Recovery Tool (not free) it can remove CryptoLocker/Ransomeware. Also try HitmanPro (see below).
Kaspersky TDSSKiller (time=5 minutes)
- Download the TDSSKiller.exe file and copy it to your USB flash drive
- Run the TDSSKiller.exe file on the infected target computer (Restart - press F8.- choose Safe Mode - run TDSSKiller.exe)
- Wait until the scanning and disinfection completes.
- A reboot might be required after the disinfection completes.
MBAR - Malwarebytes Anti-Malware (time=2-5 hours)
Follow the instructions here (or see Tutorial 119 for a way to add it to a multiboot (E2B) USB Removable Flash drive. Note: an internet connection is required when you use HitManPro, so the infected system must be connected to the internet.
Other bootable AV LiveCD ISOs
It is better to boot from a clean USB drive to a linux or WinPE-based recovery solution (LiveCD) than try to run a program from the infected Windows system itself.
Create an Easy2Boot USB drive and download and drag-and-drop these various AntiVirus ISO files to the E2B USB drive's \_ISO\ANTIVIRUS folder. Details on how to make an E2B multiboot USB drive can be found on the E2B Tutorial 72a.
- AVG Rescue CD 120.120823 AVG Rescue Toolkit CD ISO here
- Kaspersky Rescue CD 10.0.31.4 Kaspersky Rescue Disk ISO here (also .mnu file available so can have updates stored on USB drive)
- Bitdefender Rescue CD 2.0.0 Bitdefender ISO here (.mnu available for persistency - keeps downloaded updates in memory - see Tutorial 10 for details)
- Dr Web AV CD
- Rising AV CD
- VBA Rescue CD
- EScan Toolkit
- Anvi Rescue Disk
- Download ArcaNix
- Download Comodo Rescue Disk
- Download ESET Rescue (download ISO + tool)
- F-Secure Rescue CD
- G Data CD boot
- Download Norton Bootable Recovery Tool
- PC Tools Alternate Operating System Scanner
- Trend Micro Rescue Disk
- VBA32 Rescue (use Create bootable drive)
- Zillya! LiveCD
- VirusBuster Rescue CD
- Zillya! LiveCD
- Trinity Rescue Kit
Note: If using Easy2Boot, many of these can be added with persistent updates. Check this page for a link for each one and how to add persistence.
AV programs to run from within the OS (e.g. Windows Safe Mode)
Suggested order for disinfecting and speeding up your system
Keep a download of the following programs on your USB stick and carry it with you everywhere so you can 'rescue' an infected PC. Install them and run them to clean up the PC and improve performance:
2. MalwareBytes Anti-Malware
3. MalwareBytes Anti-Rootkit (mbar)
4. MalwareBytes Anti-Exploit BETA
5. AdwCleaner (www.bleepingcomputer.com)
6. Use Windows Control Panel - Programs - Uninstall programs and uninstall any programs you have never used
7. Uninstall all AV programs except one AV program (e.g. Avast free)
8. Run the AV (if using Avast do a 'Boot-time scan' and check for 'potentially unwanted programs' (PUPs).
9. Run MSConfig and disable all unneeded Startup items (if in doubt disable them all except the AV program and then enable any that you find you really need after rebooting!)
10. In MSConfig - Services - deselect any unwanted, resource hungry services - e.g. Fax, update services, parental controls, Media Centre stuff, Windows Search (use SwiftSearch instead!)
11. For best performance, change the Windows performance settings ((Right-click on Desktop - Personalize) Windows 7 Classic (or Basic which uses slightly more resources)
12. Right-click on Computer icon and go to Advanced System Settings - Performance Options - Adjust for best performance - Apply.
You can also disable System Restore (protection) - remember to make a restore point manually once you have a 'stable' system.
13. Tweak AV settings exclude some searched folders from a scan to improve performance (e.g. if you keep loads of files in D:\MyVideos and you never download files into that folder then you can exclude it from the AV search scans).
14. Browser - Reset (e.g. Delete Personal Settings in IE) to clear all old settings and passwords, etc. - then in your browser settings, 'Manage your search engines' and delete all but one (e.g. leave Google). Avoid 'Ask' and 'Delta Search'!
15, Run CCleaner again and Windows Disk Cleanup
16. Defrag your hard drives (Windows defrag or Defraggler)
Other Installable Windows AV programs
Microsoft Security Essentials (free and doesn't slow the system down too much)
Kasperksy AV (CD On Demand - retail version - special price!)
Dr Web CureIt http://www.freedrweb.com/cureit/
EmisSoft Anti-Malware Emergency Kit http://www.emsisoft.com/en/software/antimalware/
Malware Bytes http://www.malwarebytes.org/
Bit Defender AV Plus http://www.bitdefender.co.uk/Downloads/
Trend Micro http://www.trendmicro.ae/downloads/index.html
McAfee AV Plus http://home.mcafee.com/store/free-antivirus-trials
AhnLab AV and Removal Tools http://global.ahnlab.com/en/site/download/downloadMain.do