How To Clean An Infected Computer

by R.D. Stafford

November 26, 2004

Cleaning an infected computer today has become harder than ever. To effectively clean your system you must first learn a little about what you are trying to get rid of and what tools you need to get the job done. I'm going to try to give you some of the background, followed by the basics of getting rid of these pests.

Today there are a variety of things that can infect your computer such as viruses, worms, trojans and spyware. I refer to all of them as parasites since that word seems to best describe them. I find it best to use a multi-pronged approach to fighting parasites, so I use several software programs to find and get rid of them. Hopefully, by giving you a little of the background, you will be able to learn what tools to use and when to use them so that you may clean your computer of these parasites.

Viruses were the first computer bugs, and anti-virus (AV) software was made specifically to detect and get rid of these. Worms are a little different than viruses, which is one reason why AV software has a harder time catching them. Finally came trojan horses, usually just called trojans. These are very different than both viruses and worms. They actually take advantage of the weaknesses that are inherent in AV software. For one, most trojans actually try to hide from being detected by AV software. They also work "smarter" by creating hidden copies of themselves so that when they do get detected and cleaned, they can re-infect the computer with the hidden copy right after the AV software cleans the original infection. Basically, trojans are AV software's worst nightmare simply because AV software wasn't designed to specifically go after this type of threat. Today, AV software is much better at detecting all types of parasites than before but they will need to be redesigned and start using multiple methods if they are ever going to be effective against all parasites.

Spyware isn't a new breed of parasite. It is simply a combination of various computer exploits and they utilize various combinations of scripts, trojans and worms. Currently they take advantage of trojans the most since they are harder to detect and clean properly. Anti-spyware (AS) software was created specifically for detecting and cleaning this type of parasite, so when it comes to trojans and some worms, AS software is much better equipped to fight these than the AV software is.

First, you will need to get some software programs to help you. The following programs are what I use personally. Not only do I trust them, but they are also free for personal use. The companies that provide the free software, also provide software that they sell for use in a commercial environment. Usually, the free versions are just as good but simply don't have as many of the extra features which make the commercial versions even more attractive to use.

Anti-Spyware Software

CWShredder - You can find it at www.InterMute.com
Lavasoft's Ad-Aware - You can find it at www.LavaSoftU.S.A.com
Spybot S&D - You can find it at www.SpyBot.info

Anti-Virus Software

Grisoft AVG Free - You can find it at free.Grisoft.com

First you will want to download each of the above programs and then install them. After you install them, you MU.S.T update them so you will have the latest protection. There is one small exception: CWShredder is a stand-alone program that doesn't need to be installed, but you do need to have it check for an update to ensure that you have the latest version. If you don't update these programs and you are infected with the latest parasites, you will not be able to effectively detect and clean them from your computer, so remember to update, update, update.

Since spyware is a bigger problem today than viruses, and spyware is typically harder to find and get rid of, I suggest to start looking for spyware first. I also use the different AS software packages in a specific order so that I go after the tougher problems first and the easiest ones last.

Turn off System Restore

WinME and WinXP have a cool feature called System Restore. It is used to restore your computer to an earlier configuration in case of a problem. The only problem is that it wasn't made with parasites in mind, and often it can't tell the difference between an infected file and a good file, so it might automatically restore an infected file also if it had been in a protected area, effectively re-infecting your computer. Because of this, it is recommended to turn off System Restore before you test, and when you're done, turn it back on so you are still protected from standard computer problems.

For WindowsME
1. Click Start, Settings, and then click Control Panel.
2. Double-click the System icon. The System Properties dialog box appears.
  
  NOTE: If the System icon is not visible, click "View all Control Panel options" to display it.
3. Click the Performance tab, and then click File System.
4. Click the Troubleshooting tab, and then check Disable System Restore.
5. Click OK. Click Yes, when you are prompted to restart Windows.
For WindowsXP
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore" or "Turn off System Restore on all drives."
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.

Run Disk Clean-Up

This actually comes with Windows and has been installed by default since Windows 98. You can find it by clicking the Start Button and then going to Programs / Accessories / System Tools / Disk Clean-up. I recommend selecting all of its options except the ones for Office Setup Files and Compress Old Files if you have them. While you may select those if you wish, they aren't as important. This will clean up all of the temporary files so your testing will go faster, and may also delete any spyware that may hiding there if the spyware isn't already running.

Run CWShredder

This is made for detecting and cleaning of the infamous CoolWebSearch exploits. Currently there are about 40 types of these, each with up to 4 variants and growing. These are some of the toughest ones to get rid of.

Run Ad-Aware Next

This handles the next toughest types the best. When it finally presents you with the list of parasites it has found, put a check mark in the box next to the ones you want to get rid of, I suggest checking them all. If you want to select all, just right-click your mouse on the boxes to get the options menu, and left-click on Select All. If it says it can't get rid of a problem right now, it will ask if you want to run it again after you restart your computer, answer yes and restart your computer so it may test again.

Run Spybot Next

When you run it, it will automatically select all the spyware that it finds, if there is something you don't want to get rid of for some reason, deselect it and then let Spybot fix all of the rest of the problems that it finds. This program also will ask to restart your computer so it can test again if it has problems removing something, so let it.

Now Run The AVG Program

Have it scan for the remaining parasites that the others may have missed. If you found any parasites, you need to restart your computer so you can test everything again. There are times that after cleaning certain parasites, you will need to test again because something may have been hidden earlier by the infection. So repeat this process of testing and restarting until you find no more parasites.

These procedures should have cleaned most cases of infection that you will find. Yes I said MOST because there are some infections that are very hard to detect and remove. Generally, if you have one of these, you will need the assistance of an expert to help you get rid of it.

When you believe you are finished, remember to turn System Restore back on if you had turned it off.

I recommend testing for parasites as often as you can, probably at least once a month if not more. The sooner you catch them, the less damage they can do to your computer, and the less chance of a hacker finding your sensitive information such as checking account info, passwords, etc.

NOTE: This is a Guest Article on the ComputerBob.com Web site. Guest Articles contain reviews, opinions, tips, and other material written by guest authors. Articles may be submitted for possible publication to the email address listed on the Contact page (a Contact link appears at the bottom of every article). ComputerBob edits all submitted articles before publishing them. By submitting an article to ComputerBob, the submitter implicitly grants ComputerBob the right to edit it and to publish it as a Guest Article on the ComputerBob.com web site. Guest Articles reflect the views of their authors only. ComputerBob is not responsible for the accuracy or reliability of Guest Articles.