Official Malware Removal Guide
by: /u/cuddlychops06 for /r/techsupport // Updated: September20th, 2017.
Changelog: 9/20/17 - Updated some screenshots, removed JRT recommendation - see below
If you suspect you are infected with Crypto malware (Cryptowall, Cryptolocker, TeslaCrypt, etc) DO NOT follow this guide! Please make a post instead. Your files are at stake.
Purpose & Scope of this Guide:
This guide is designed to assist you in removing malware from an infected system that successfully boots. If your computer is completely unable to boot due to malware, please make a post, as this guide will not help you. If you perform the following steps exactly as described, this will solve your problem in over 90% of scenarios. That said, not all malware is created equal, and not all malware removal tools are created equal. The tools recommended in this guide were picked because of their high success and low failure rates, measured on a very large scale. However, there will be times that this guide fails in removing malware. If that is the case, please make a post for further assistance, stating that this guide was unsuccessful. It is recommended to only accept advice from a “Trusted” technician. I am writing this guide in layman’s terms so that most people will be able to understand it with ease.
Disclaimer:
The following instructions are recommendations only. You take full responsibility for any steps you choose to perform on your computer. While the following recommendations are performed without issue on countless machines, there is always a risk of damaging your Operating System or experiencing data loss on any machine. It is solely YOUR responsibility to save all work and back up any and all important data on your system before proceeding. Also note that once a computer has been compromised with malware, it should not be considered clean until a complete reformat has taken place.
Malware Remediation Steps:
Before proceeding, go into your browser’s extensions and remove all suspicious items. Also go into your browser’s settings and remove any default search providers and unusual homepages. If you are unsure how to do this, proceed to Step 1.
Download and run the following tools in this order. Run all tools unless otherwise instructed. All tools should be run in Normal Mode (not Safe Mode) unless you are unable to boot Normal Mode, or the scans fail in Normal Mode. All tools must be run under an Administrator account. Do not remove any tool-generated logs in the event a helper needs you to post them to further assist you.
1) Run rkill.com. Sometimes it takes a few minutes to finish. Do not reboot when done.
-
Kills running malicious processes
-
Removes policies in the registry that prevent normal OS operation
-
Repairs file extension hijacks
2) Download an updated copy Malwarebytes 3.0. Turn on the “Scan for Rootkits” option. Then, run a “Scan”
- Successfully removes the vast majority of infections
- Has an industry-leading built-in rootkit/bootkit scanning engine
- Has built-in repair tools to fix damage done by malware
3) Run Malwarebytes ADWCleaner using the “Scan” option.
- Removes majority of adware, PuPs, Toolbars, and Browser hijacks
- Fixes proxy settings changed by malware
- Removes certain non-default browser settings
NOTE: It is no longer necessary to run JRT. The JRT definitions have been rolled into ADWCleaner by Malwarebytes. JRT no longer provides additional benefit.
Optional, Advanced Step (only run if previous tools fail to solve problem):
4) Run Sophos HitmanPro
HitmanPro is a phenomenal "second-opinion" malware scanner.
Please note: If malware has prohibited you from browsing the web or downloading files, you can try running the NetAdapter Repair Tool with all options checked which will attempt to restore your internet connection & default browser settings. You may have to download these tools on another computer and move them to a flash drive that you can plug into the infected machine.
Have adware or spyware on your Mac?
Try Malwarebytes Anti-Malware for Mac (formerly Adware Medic). Please make a post if it is unsuccessful.
If you have run all of the above tools successfully, you should be malware-free. If you are still experiencing problems, please make a post in /r/techsupport for further assistance.
Follow-up Steps (highly recommended):
- Using a computer that has not been infected, change passwords to all your online accounts.
- Consider enabling two-factor authentication.
- Install a better anti-virus. See recommendations below.
What is malware?
Malware is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software. [Source: Wikipedia.com]
How did I get infected?
It is difficult to track down the source of an infection. Most infections are actually given permission to run unknowingly by the user. It is recommended to keep User Account Control turned on and never give access to something you do not trust or did not open. Many other infections come via exploits in your browser or browser plug-ins on websites you visit. Always be very careful what you install. Make sure you trust the source implicitly. When downloading programs, always use the publisher’s website directly.
How to prevent future infections:
Be very careful what you download and install. Keep programs like Java & Flash up-to-date, but do so using their official websites or Ninite installers. Use Unchecky to prevent accidental installation of adware & spyware during product installations. Make sure Windows is kept up-to-date as well. Many Windows updates patch exploits and vulnerabilities in your operating system. Most infections are active because the user has unknowingly given it Administrative permission to install and run. The first line of defense starts with you.
The following tools will aide you in keeping your computer clean:
Free Anti-Virus Suggestions:
Helpful Tools:
