How do I remove a virus if it prevents me from download or installing anything?

The Problem: Malware Interferes

The problem that you're seeing is that the malware on the machine is actively looking for you to try to remove it.

It's watching for downloads that "look like" anti-malware tools, and it's watching for web or other access that might be going to anti-malware sites. It's even monitoring what programs you run. When it sees you doing that (or other things that could lead to its removal) it steps in and either redirects you to sites of its choosing, or simply causes the operation to fail.

We'd love to download and run anti-malware tools, but we can't.

Temporarily Kill the Malware

One possible solution to the blocking problem is to temporarily kill the malware that's running. This won't remove it, but may allow you to download tools that will.

The folks at BeepingComputer.com have created a tool called RKill (be careful: at this writing there's an ad immediately above the download link that looks like the download link. It is not. Be sure to grab rkill itself).

You may need to download rkill on another machine (because of course it may well be blocked on the infected machine), but you can quickly copy it over using a USB drive or something else.

You may also need to rename rkill.exe to something else (like "notrkill.exe" or "leo.exe" or something else). Once again, the malware may be paying attention to the name of every program being run, and may prevent the software from running if it recognizes the name.

Run the program and do not reboot. Rebooting will "undo" the effect of having run rkill, and any malware that rkill killed will be back.

Download and Run Malwarebytes' Anti-Malware

Malwarebytes' Anti-Malware is currently one of the most successful tools at identifying and removing the types of malware we're talking about here. It's not really a replacement for anti-virus software (you'll find them saying so in their support forums), but particularly in cases of infection it has a pretty darn good track record.

Download the free version, install it and run it and see what it turns up. (You may need or just want to download on the other machine and copy the download over as you did rkill.)

Try Other Tools

After running rkill you may, or may not, be able to run some of the other tools that the malware was blocking. You can try registry editing tools, the task manager, process explorer or others.

You can also try your other anti-virus and anti-spyware tools as well - perhaps they'll be able to download an update that catches this problem, or perhaps you can download a new tool that will.

But in general my money's on Malwarebytes.

What If It Doesn't Work?

If none of that works, things get complicated.

There are a couple of things you can consider trying:

• Boot from a bootable antivirus rescue CD. There are several, including from anti-virus vendors like Avira, AVG and several others. If you have a favorite anti-malware vendor, check with them to see if they provide a bootable scanning solution.

  The reason that these are interesting is that they boot from the CD, not your hard drive, so the malware doesn't have a chance to operate and block you. You can then run a scan of your hard disk and hopefully clean it off.

• Remove the hard disk and place it in or connect it to another machine. Hardware issues aside, this needs to be done with care to prevent the malware from spreading, but just like booting from that CD this boots from the new machine's installation, not yours. You can then run anti-malware tools against your drive and, hopefully, clean it off.

Restore From Backup

If you have a recent system backup it's possible that restoring to that will take your machine back to a time before it was infected.

Regular backups are wonderful for this.

But beware, that they do have to be the correct type of backup: full system backups. Simply backing up your data, while better than not backing up at all, will not be helpful in a scenario like this.

And for the record, System Restore is pretty useless when it comes to bad malware infections like this (if it hasn't already been completely disabled by the malware, of course).

The Final Solution

It sounds dire, because it is.

As I've mentioned before, once your machine is infected it's no longer yours. You have no idea what's been done to it. And you also have no idea whether or not any or all of the cleaning steps you took removed any or all of the malware that was on the machine.

In other words, you know it was infected, but there's no way to know that it's not now.

Scary, eh?

The only way to know with absolute certainty that malware has been removed is to reformat your machine and reinstall everything from scratch.

Sadly, it's also quite often the most pragmatic approach to removing particularly stubborn malware. Sometimes all the machinations we go through trying to clean up from a malware infection end up taking more time than simply reformatting and reinstalling.

And reformatting and reinstalling is the only approach that's known to have a 100% success rate at malware removal.

If you don't have a backup of your data then before you reformat at least copy the data off somehow. Boot from a Linux Live CD if you have to (Ubuntu's a good choice) - that'll give you access to all the files on your machine and allow you to copy them to a USB device or perhaps even upload them somewhere on the internet.

Aftermath

After things are cleared up and working once again, take a few moments to consider how to prevent it from happening again, or what you can do to make the next time easier:

• See if you can identify how the infection occurred, and to the extent that you can: never do that again.

• Make sure you have all the up to date security measures that it takes to stay safe on the internet.

• Consider investing in a backup solution of some sort. Nothing can save you from more different kinds of problems than a good, regular backup.

As I said at the beginning - prevention is much easier than the cure.