This Malware thing is becoming such a common issue that its driving me up the wall (In My opinion).  I’ve been ask by many customers if its just tech’s creating these malware infections for job security.  Let me tell you that I can promise you no tech worth his knowledge wants this kind of job security.  (End of my Soapbox)

So what do you do with your computer to give you a fighting chance?  Here is what you should do

Now that your pc is not infected

1 – Verify that you have “Fairly recent”* version of antivirus software installed, and that the AV software at is installed is running the latest Definitions possible.

a – *What do I mean by fairly recent, if you find your antivirus software and it says anything less than 2009 in the name (as in Norton 2005, McAfee 2003, etc.) then its to old.  Antivirus software that old will just not have the information needed to keep up with the ever changing landscape

b – If its older than 2009, then I recommend just uninstalling it, and downloading a free Antivirus offering.  (See the next answer for recommendation)

c – What if you find that you don’t even have antivirus installed or that the one you have is old.  I recommend visiting www.ninite.com (http://www NULL.ninite NULL.com).  There you will find a selection of Free Up to Date antivirus offerings.  There are a couple of offerings, I would recommend MSE (Microsoft Security Essentials), but you would not do bad with any of the ones listed.  Its at least better than the situation you were in.  All you need to do is put a check next to one you select, then at the bottom select “Get Installer”, and hit run when prompted.  It should download and install it for you.

**Remember to uninstall any old antivirus before installing its replacement, as pc’s don’t like to have 2 AV software running at the same time.

2 – Now that we have the AV situation address, you now need to add 2 pieces of free software to your install.  It is hoped that you never need to use them but it makes life much easier if you install them now, before you get infected.  (Think about it like car insurance, you don’t want to try and get the insurance after crash, same thing applies here for the software).

a – Go back to www.ninite.com (http://www NULL.ninite NULL.com) and select Malwarebytes and SuperAntiSpyware. Click on the “Get Installer” button at the bottom and then click run when prompted.  That should install both.

b – Once installed you want to open each of the 2 programs you just installed at least once to make sure they installed correctly, and also to update the programs to the latest definition files. You should also run a full scan with each of the 2 programs on all hard drives.  To make sure that nothing is hiding in your system.

c – If either Malwarebytes or SuperAntiSpyware finds anything during its scans it will tell you at the end and very simply help you clean up your pc.  (Just select the infected files found and select remove infected)

3 -   Lastly, go back to www.ninite.com (http://www NULL.ninite NULL.com) , and select the following files

• QuickTime
• Flash
• Flash (IE)
• Java
• .NET
• Silverlight
• Air
• Adobe Reader

These are all programs that most average users have installed, and vulnerabilities in old versions of these programs are some of the most common ways that many of the bad guys use to infect pc’s. Once you have all of these selected, click on “Get Installer” and then click on run when prompted.

You may notice that I list www.ninite.com (http://www NULL.ninite NULL.com) a lot in the options above.  Just to make it clear, Tech Geek and More has no direct or indirect participation with ninite.  Ninite is just a TGM recommended site, because they make updates simple, opposed to having to visit multiple sites to get the the updates accomplished. In addition, TGM appreciates the fact that when you install these programs via Ninite, they do not install Toolbars, or other junk that drives all Techs crazy (as we have to constantly uninstall Junk).

 

What to do once you do get infected

Unfortunately, even with taking every precaution imaginable its still possible to get infected. At the point of being infect here is what you need to do

1 – DON’T PANIC! (Seriously, if you panic you will not remember to follow the following steps and will probably make things worse)

2 – Immediately shut down the pc.

a – Try to do it by clicking on Start – Shutdown – Shutdown on the screen and if that doesn’t work, then just hold the power button on the pc until the pc powers off.

3 – Once the pc is off, power it back on and as soon as pc starts to boot press F8 over and over, until you get to the safe mode screen choices, use the up/down arrow to select safe mode with networking and hit enter

**Keep in mind that in safe mode your pc will look a little “odd”, that is normal.**

4 – Once you get into your pc, Go to start –> settings –> control panel –> and click on internet options –> then go to connections tab –> and click on LAN settings (toward bottom) and make sure nothing in that window is checked, if it is uncheck it, then click ok

5 – At this point if you have not installed SuperAntiSpyware or Malwarebytes, go to Step#2 under “Now that your pc is not infected” (above) and follow those steps to install both programs.

6 – Once installed, start by running SuperAntispyware, and when prompted select yes to update definition files. Once definitions are updated, run a Full Scan on all your Hard Drives (That would be any drive that doesn’t hold a CD or DVD).

The scan will probably take 1 hour on most average sized drives (Average = 320 gig drives). Once scan is completed, select all files that show infected and then click on remove select.  That covers part of the process.  Now to the next part.

DO NOT REBOOT IF PROMPTED

7 – Now start Malwarebytes, and when prompted say yes to updating the definition file.

8 – Once updated, select Perform full scan and hit select

You will then be asked to select your drives, select all drives that don’t use CD or DVD and press Scan

The scan will probably take 1 hour on most average sized drives (Average = 320 gig drives). Once scan is completed, select all files that show infected and then click on remove select.  That covers part of the process.  Now to the next part.

IF PROMPTED AGAIN –> DO NOT REBOOT
9 – Now in Windows –> Go to start –> run –> and type msconfig
a – This opens the msconfig window.  Under the start up tab –> Uncheck all items listed.  (DO NOT touch any of the other tabs) and click ok.

IF PROMPTED TO REBOOT –> AGAIN SAY NO

There is 1 more step.
10 – Open up My computer and go to –> c:\ drive –> windows folder –> system32 folder –> drivers folder –> etc. folder and in that location find a file called hosts and double click it, when prompted select to open with notepad.

Once the file opens look for the following line “#    127.0.0.1       localhost”

As shown in the example anything below the 1st 127.0.0.1 needs to be deleted.  Then save your changes by clicking on File –> Save.

Once you have done all this reboot.

After the clean up in safe mode

After the clean up in safe mode, and the reboot, there are still a couple of things you need to do.

1 – You will need to reinstall your Antivirus product.  If you were infected, there is a chance that your AV product is compromised, if nothing else, it just makes sure its complete or gives you a choice to pick a new AV package. This is especially important if your AV software is a few years old.  Make sure to uninstall then reinstall.

2 – Using the Step#3 in the “Now that your pc is not infected” section. Make sure you update the programs listed in that section.

With that you should be back up and running.