Malware Removal and Prevention: Overview

From CastleCopsWiki

With the basic understanding of why you have decided to undertake this procedure (as explained in the Introduction), we have designed the following Malware Removal and Prevention procedure. This procedure consists of several malware steps that should be performed in sequence, followed by instructions how to post a HJT log should it be required. It concludes with prevention measures you can implement to properly maintain a secure system.

Please follow the instructions listed below. If you find you are still experiencing computer problems after these steps are completed, you may then post a HJT log and receive expert assistance in cleaning any infections which remain.

Save this 'checklist' of removal programs you have run, because we will be asking you to provide us with that information when it comes time to post a HijackThis log. Good Luck!

1. Perform a reference (preliminary) HijackThis scan
   
   
2. Winfixer / WinAntiSpyware / WinAntiVirus Popups / Virtumundo victims only (Unsure? - then proceed to Step 4):
   Please follow the Virtumundo Removal Instructions for all versions of Windows including Vista.
   
   
3. Windows 2K/XP/Vista - Privacy Protector / AntiVirGear / SpyLocked / VirusBurst(er(s)) / SpyFalcon / SpyAxe victims only (Unsure? - then proceed to Step 4):
   Please follow the Smitfraud Removal Instructions instead of steps 4-8 below.
   
   
4. Next stop - The Control Panel - Add/Remove Programs
   
   
5. Temporarily Disable Real Time Monitoring Programs
   
   

   ---

   Now please complete the following automatic malware detection and removal steps

   After you have installed the scanning programs listed below, please be sure to update them. A security program is only effective if it updated with the latest definitions. Updating will help provide protection against the most recently introduced security threats.

   ---

   
   

6. Clean the Clutter:
   • CCleaner (All versions of Windows including Vista)
   • ATF Cleaner (Win 98/ME/2K/XP and Vista)
   
   
7. Antispyware Scanners - Run at least one, preferably two - if your system is functioning well enough:
   • Ad-Aware (Win 98/Me/NT/2000/XP)
   • SpyBot S&D (Win 95, 98, ME, 2K, XP, 2003, PE, Vista)
   • Windows Defender (Win XP SP2, Win 2003 SP1+, Vista) - This scanner will remove the Sony XCP DRM rootkit
   • SUPERAntiSpyware (Win 98, ME, 2K, XP, 2003, Vista)
   
   
8. Antiviral Scans - Run at least one
   
   
9. AntiTrojan Scans - Run one:
   • AVG Anti-Spyware (formerly ewido) (Win2K, XP and Vista)
   • TrojanHunter (Win 98, ME, 2K, XP, 2003, and Vista)