My computer's infected with a virus, how do I clean it up?

Home » Viruses and Malware » Malware Detection

Summary: Once infected it's difficult to guarantee that your cleaning efforts succeed. Best is to make sure that you never get infected in the first place.

•

I have a couple of reactions to this question.

One, of course, will be the steps I'd take to try and recover in this case. I'll outline those in a second.

But first, my other reaction, which you may not like .

•

"... I get viruses all of the time."

This is unacceptable.

In my opinion you must change that mindset. Getting a virus, any virus, should be considered a very serious thing. Your teens, or whomever is using your computer in such a way as to get infected by these viruses, must learn to use the computer safely and properly.

There's simply no substitute for that.

If this is a computer you share with your teens, I'd be doubly concerned. In fact, in your shoes I'd be barring their access ... letting them allow your machine to become infected with viruses is putting everything on your computer at risk. You could lose everything stored on your computer.

So why am I so passionate about this?

It's simple really: consider the possibilities after you're infected with a virus:

1. Your anti-virus program successfully cleans it off.

2. Your anti-virus program thinks it successfully cleans it off, but in fact the virus has hidden itself so well that it remains. You're still infected, and you don't know it.

3. Your anti-virus program doesn't catch it and doesn't even try to clean it off. You're still infected, and you don't know it.

4. Your anti-virus program fails to clean it off and tells you. You're still infected, but at least you know.

Because we trust that #1 will happen all the time, it's easy to become complacent. It's easy to assume that viruses are a fact of (teenage?) life, and that we can just clean them up after they happen.

That's just not true. A lot of malware can't be so simply swept away.

The only way to absolutely, positively clean a machine from a virus is to completely reformat the machine and reinstall the operating system, updates, applications and data from scratch.

Re-read that sentence. It's important and absolutely true.

Most of the time we don't do that. We assume, we hope, that the anti-malware software we have running will clean things up for us. But there's actually no way to know for sure.

Each time we allow an infection to happen, each time we then use anti-malware software to clean off an infection, we're gambling. Most of the time, we're ok. But sometimes we're not. (I do have to mention that finding a virus on your machine and finding a virus installed on your machine are two different things. Anti-virus programs will report both, but it's the later case that is the problem scenario.)

Rant over.

Let's look at your situation.

•

As you can guess by now the only guaranteed way to rid yourself of this malware is to reformat your machine and reinstall everything. That's very painful and something I know that most people would want to avoid, including me.

So here are steps I would try first:

• Backup your system. Yes, we're backing up the infected system, but in case subsequent attempts go horribly wrong we'll always then have this backup to revert to as we attempt other approaches to recovery.

• Run the System File Checker. Many viruses operate by replacing system components - the System File Checker will attempt to restore them. Make sure to have your original Windows installation CD ready, as SFC will typically ask for it if it finds it needs to restore files.

• Perform a repair install of Windows. This works very much like an full install, replacing and updating system files and other components, but it attempts to preserve all data and installed programs in the process.

If those don't work ... well, by now you know what's next.

•

Once your machine is clean, I'm going to strongly recommend you implement a frequent backup regimen. Daily would be nice, making sure that you save each day's information so that if necessary you can revert to a backup from "x days ago".

The reason I say this is that as much as we might want to make sure that your teens never, ever allow your machine to get infected again (and that should absolutely be the goal), the practical reality is that it ain't gonna happen. At least not right away.

With a sequence of daily backups, if you do get infected again you could simply restore the machine to the most recent backup prior to the infection. Yep, you'll lose any changes made after that backup, but my guess is that'll be a lot less painful than a full reinstall.

And it might even act as an incentive to avoid infections in the future.

Related:

• Ask Leo! - My computer has a virus infection; how much has been compromised?

• Ask Leo! - How do I remove a file that my anti-virus says can't be quarantined?

Article C3263 - January 10, 2008