112 - Virus/RootKit/Ransomware Removal and CleanUp

If the usual AV programs don't work (in Windows Safe Mode), try booting from a USB drive.

On an uninfected PC - partition and format a USB Flash drive using RMPrepUSB (this cleans the drive of any virus that might already be on the flash drive)

The following programs can be downloaded on an uninfected computer and copied to a USB Flash drive.

Then connect the flash drive to the infected computer and boot from it to run the program. If you have a Windows 8 system, you may need to change the BIOS settings to enable BIOS Legacy or CSM Boot mode (not pure UEFI Mode).

WARNING: Ransomware is becoming very prevalent and there are now many decryption programs available. See here and here and here.

This type of malware encrypts your documents and files and then they demand a 'ransom' payment to decrypt it for you. It is important to realise that even if you have synchronised online Cloud Storage folders, these will also get encrypted! Therefore synchronising your documents to the 'Cloud' (e.g. DropBox) does not protect you from Ransomware. PLEASE MAKE SURE YOU HAVE A CURRENT BACKUP OF ALL YOUR IMPORTANT FILES IN OFF-LINE STORAGE - for instance use a 1TB USB 3.0 portable hard drive which you keep in a locked drawer. Set a date in your calendar to make a regular backup onto this drive.

Note: Dropbox keeps previous versions, so you may be able to recover a previous unencrypted version of you files.

Tip: Try the free Norton Power Eraser. If used in conjunction with the Norton Bootable Recovery Tool (not free) it can remove CryptoLocker/Ransomeware. Also try HitmanPro (see below).

For an independent evaluation of the various AV products available - see here. For test reports see here.

Rootkit disinfection

Kaspersky TDSSKiller (time=5 minutes)

1. Download the TDSSKiller.exe file and copy it to your USB flash drive
2. Run the TDSSKiller.exe file on the infected target computer (Restart - press F8.- choose Safe Mode - run TDSSKiller.exe)
3. Wait until the scanning and disinfection completes.
4. A reboot might be required after the disinfection completes.

MBAR - Malwarebytes Anti-Malware (time=2-5 hours)

1. Download MBAR free version and copy to a USB flash drive (there is also an Anti-RootKit BETA)
2. Run the program on the target system in safe mode and select the full, deep-scan option
3. Go and get a cup of tea - it could take a while!

HitmanPro.Kickstart (anti-ransomware)

Follow the instructions here (or see Tutorial 119 for a way to add it to a multiboot (E2B) USB Removable Flash drive. Note: an internet connection is required when you use HitManPro, so the infected system must be connected to the internet.

Other bootable AV LiveCD ISOs

It is better to boot from a clean USB drive to a linux or WinPE-based recovery solution (LiveCD) than try to run a program from the infected Windows system itself.

Create an Easy2Boot USB drive and download and drag-and-drop these various AntiVirus ISO files to the E2B USB drive's \_ISO\ANTIVIRUS folder. Details on how to make an E2B multiboot USB drive can be found on the E2B Tutorial 72a.

1. AVG Rescue CD 120.120823 AVG Rescue Toolkit CD ISO here
2. Kaspersky Rescue CD 10.0.31.4 Kaspersky Rescue Disk ISO here (also .mnu file available so can have updates stored on USB drive)
3. Bitdefender Rescue CD 2.0.0 Bitdefender ISO here (.mnu available for persistency - keeps downloaded updates in memory - see Tutorial 10 for details)
4. Dr Web AV CD
5. Rising AV CD

VBA Rescue CD
EScan Toolkit
Anvi Rescue Disk
1. Panda Safe CD 4.4.3.0 Panda Security ISO here
2. Avira AntiVir Rescue System - rescue_system-common-en.iso and Restore CD SATA.iso
3. Windows Offline Defender - Save as ISO and copy to E2B flash drive.
4. Dr Web CureIt Live CD http://www.freedrweb.com/livecd/
Download ArcaNix
Download Comodo Rescue Disk
Download ESET Rescue (download ISO + tool)
F-Secure Rescue CD
G Data CD boot
Download Norton Bootable Recovery Tool
PC Tools Alternate Operating System Scanner

1. Quick Heal Emergency disk (WinPE based) - download - install - make ISO
2. Rising Antivirus Rescue CD (2010)
3. Sophos Bootable Anti-Virus (see this page for insturctions)

Trend Micro Rescue Disk

1. VBA32 Rescue (use Create bootable drive)

1. Avast AV Rescue ISO/USB drive (see here for details)

Note: If using Easy2Boot, many of these can be added with persistent updates. Check this page for a link for each one and how to add persistence.

AV programs to run from within the OS (e.g. Windows Safe Mode)

Suggested order for disinfecting and speeding up your system

Keep a download of the following programs on your USB stick and carry it with you everywhere so you can 'rescue' an infected PC. Install them and run them to clean up the PC and improve performance:

1. CCleaner

2. MalwareBytes Anti-Malware

3. MalwareBytes Anti-Rootkit (mbar)

4. MalwareBytes Anti-Exploit BETA

5. AdwCleaner (www.bleepingcomputer.com)

6. Use Windows Control Panel - Programs - Uninstall programs and uninstall any programs you have never used

7. Uninstall all AV programs except one AV program (e.g. Avast free)

8. Run the AV (if using Avast do a 'Boot-time scan' and check for 'potentially unwanted programs' (PUPs).

9. Run MSConfig and disable all unneeded Startup items (if in doubt disable them all except the AV program and then enable any that you find you really need after rebooting!)

10. In MSConfig - Services - deselect any unwanted, resource hungry services - e.g. Fax, update services, parental controls, Media Centre stuff, Windows Search (use SwiftSearch instead!)

11. For best performance, change the Windows performance settings ((Right-click on Desktop - Personalize) Windows 7 Classic (or Basic which uses slightly more resources)

12. Right-click on Computer icon and go to Advanced System Settings - Performance Options - Adjust for best performance - Apply.

You can also disable System Restore (protection) - remember to make a restore point manually once you have a 'stable' system.

13. Tweak AV settings exclude some searched folders from a scan to improve performance (e.g. if you keep loads of files in D:\MyVideos and you never download files into that folder then you can exclude it from the AV search scans).

14. Browser - Reset (e.g. Delete Personal Settings in IE) to clear all old settings and passwords, etc. - then in your browser settings, 'Manage your search engines' and delete all but one (e.g. leave Google). Avoid 'Ask' and 'Delta Search'!

15, Run CCleaner again and Windows Disk Cleanup

16. Defrag your hard drives (Windows defrag or Defraggler)

Other Installable Windows AV programs

Microsoft Security Essentials (free and doesn't slow the system down too much)

Kasperksy AV (CD On Demand - retail version - special price!)

Kasperksy PURE (CD on Demand - retail version - special price!) - click here for MAC version

Norman AV http://www.norman.com/home_and_small_office/products/norman_antivirus

Dr Web CureIt http://www.freedrweb.com/cureit/

EmisSoft Anti-Malware Emergency Kit http://www.emsisoft.com/en/software/antimalware/

AdAware - http://lavasoft.com/products/ad_aware_free.php

Malware Bytes http://www.malwarebytes.org/

Bit Defender AV Plus http://www.bitdefender.co.uk/Downloads/