How to clean an infected Windows PC:  A guide, plus advice needed.

nick779 · 2018-03-21T19:06:26.000Z

Daily protection : Webroot - Solid performance for the last few years when it comes to detection, protection, and removal tests

when SHTF, Avira has one of the highest detection and removal rates, but wasnt too good at real time protection for some reason, I typically use this.
Malwarebytes gets a full scan
SuperAntispyware gets a full scan

When that fails, format and reinstall.

chops728 · 2018-03-21T19:14:22.000Z

First off I use Acronis backup software— anything that makes an Disc image will work— After clean install I make an image— then periodically make new images as I ad programs updates etc—-This way if you get infected you restore to the closest image you have (saves hours and hours of work) One of the most important things I feel is to put all my data files on a separate partition—that way if you have to restore or reinstall you don’t loose all your shit—— for years I have been using Ace Utilities for clean up (registry temp files etc) I also run Webroot Antivirus only —it has a firewall and malware software included—I find it has the least drain on resources,Every now and then I might have some sort of bull crap happen but it’s rare—No big deal when you have backups

Recently I had 2 machines after installing Windows 10 major update—they ran fine a day or two —but then all of a sudden when restarting they just sat in an endless loop—one was my stepson’s — his backup was about 1 1/2 yrs old so he lost all of his programs he had added but none of his data—— I usually check to see how current my last Backup is — even before doing updates— I’ve had a new version of Quickbooks crash my wifes payroll PC before

gi.lumens · 2018-03-21T19:33:05.000Z

Always have a clean backup system with the latest Antivirus handy that is set NOT to automatically run any media that is connected to it. Pull the HDD/SSD on infected machine use cable/enclosure connect to clean system and procceed to clean. The programs you mentioned are all usefull in there particular way just make sure you only have one running at a time or you can get false positives. I dont clean machines like i used to, but another safer way that only let one program run at a time is Hirens boot CD running on the clean system and connecting hdd/ssd. You can create a custom Hirens CD and boot to from infected machine and clean straight from CD. Also, BleepingComputer.com has everything you need plus tutorials for beginners.

sb56637 · 2018-03-21T19:34:09.000Z

How do YOU clean an infected Windows PC?

I format the disk and install Linux on it. :smiling_imp:

AgentSteel · 2018-03-21T20:22:56.000Z

What I do when I’m too lazy to format / reinstall Windows AND the system is seriously infected :

offline disinfection (boot your system with an antivirus boot CD or usb drive)
boot system and run another stand-alone disinfection tool (DrWeb CureIt generally works OK for me)
install a good AV

Basically a 2-stage disinfection.

If there’s still some malicious crap after that, then :person_facepalming:

Also all my personal computers run Linux :smiling_imp:

raccoon · 2018-03-21T20:46:03.000Z

sp5it · 2018-03-21T20:50:16.000Z

Using NOD32 I didn’t have infection since a few years.
Not browsing porn or warez sites helps a lot xD
Mike

raccoon · 2018-03-21T20:57:11.000Z

sp5it:

Not browsing porn or warez sites helps a lot xD

My mom doesn't browse that kinda stuff; I think she opened an infected email link.

She's usually pretty good at avoiding infections, but she's not perfect.

I, on the other hand, browse some dangerous sites, but I claim that I know what I'm doing.

I haven't had an infection in years, so maybe I'm right.

WalkIntoTheLight · 2018-03-21T20:57:59.000Z

sp5it:

Not browsing porn or warez sites helps a lot xD
Mike

Sure, but that’s only because I wouldn’t be using my computer at all!

moderator007 · 2018-03-21T20:58:52.000Z

Give it a shot of antibiotics.

Persechini · 2018-03-21T21:04:29.000Z

Windows defender

copperheaded · 2018-03-21T21:10:55.000Z

My preferred method:

moderator007 · 2018-03-21T21:12:58.000Z

Ha, ha That’s funny right there^

dchomak · 2018-03-21T21:19:39.000Z

Threadneedle:

All of the tools you’ve listed about work well for me and have done so for years; however, I tend to find that to give it a really good clean you need to take out the hard drive(s) from the system and manually clean them. It usually takes a couple of hours so I make sure that my schedule is clear. I will use the room with the least dust and close the door so that no more dust can be introduced. First of all I’ll take the drive out and use a precision screwdriver to undo the screws of the drive unit. Once the cover is off I set it to one side and wipe my fingers to get rid of the dust on them. I then carefully disassemble the actuator assembly and then the spindle, which now gives me free access to the platters… This is where we really get to work. I will then clean the platters using Brasso and a soft microfibre cloth. If there is a lot of malware then after use Brasso I will then also put the platters into a lint free pouch and put it into the washing machine on a very gentle cycle - I only use nonbio for platters. Once all of this is done I will reassemble the unit, making sure to use a straw as I’m just about to close the unit to recreate the hermetic environment they were in. SSDs are much easier to be cleaned and I simply use a diluted mixture of lemon juice, avacado, and greek yoghurt.

Hillary uses bleach.

moderator007 · 2018-03-21T21:37:21.000Z

Anyone ever seen this take over screen before?

.
I find that usually one certain antivirus software will work better for getting rid of unwanted guest.
But it’s usually depends on which type of virus, hitchhiker or trojan you get.
Seems that some software company’s specialize in different problems. I have always kind of thought to myself, that it wouldn’t be to hard for some of these company’s to release this stuff through back channels so that they could profit from the fix.
Just my two cents.

raccoon · 2018-03-21T21:28:15.000Z

moderator007:

Anyone ever seen this take over screen before?

I have not seen that...

Looks like a scam.

sp5it · 2018-03-21T21:33:06.000Z

I’ve seen it. Combofix helped.
Mike

moderator007 · 2018-03-22T02:27:45.000Z

sp5it:

I’ve seen it. Combofix helped.
Mike

That used to be my number 1 go to software, but eventually it just wouldn’t get the job done sometimes. It take some other software to clean it up and sometimes another.
Yeah, the “your computer has been locked” It is a scam.

shaydu67 · 2018-03-22T02:18:56.000Z

Ever since my IT guy told me to use sandboxIE I havent had any problems.

sovereignknight · 2018-03-22T02:39:04.000Z

For the troubled customers, (The ones you keep telling them to not let the fake Microsoft scammers get on your computer and lock down the PC with a Syskey password) We reinstall Windows, Install DeepFreeze By Faronics and setup an unfrozen partition so the customer is able to work on data/install programs. If they get a virus it won’t matter. Just reboot the computer and it cleans the slate. It’s a big F-U to the fake Microsoft scammers out there.