Blog
How to remove viruses, spyware and trojans: theory and practice
Short answer: the most effective way to remove a virus, spyware or trojan is to scan the disk without booting the infected Windows (with a bootable antivirus or Live CD), end suspicious processes, and if all that fails, restore the system. In this long class I first explain the theory to avoid infections and then the practice to clean the computer. My rule: if after 30 minutes to an hour of cleaning the problem is still there, it is better to format and reinstall.
First: how to avoid viruses
These habits prevent most infections, for your own computer and to explain to your customers:
- Do not visit dangerous sites: adult sites, unknown "free" game sites and hacking sites often carry malicious code.
- Do not install cracked or pirated software: the cracks and patches that "unlock" programs like Photoshop or Office often bring viruses or trojans. If you do not want to pay, Linux and its free software are an alternative.
- Be careful with free software and trials: many installers from download sites add toolbars and other programs. Download from the manufacturer's site and choose the custom install to uncheck what you do not want.
- Be careful with flash drives, SD cards and external disks: they can carry hidden files like autorun.inf that run something when connected.
- Check external devices with a Live CD, which never gets infected.
- Use a limited user account (PC or Mac) instead of the administrator for everyday work.
- Put a password on the administrator account, so a virus has a harder time taking control.
- Set up OpenDNS on the router to filter dangerous sites for every computer on the network.
Step 1: Decide how much time it is worth
In my experience, if cleaning takes more than 30 minutes or an hour, the practical move is to erase and reinstall: in less than an hour you have everything working. If you prefer to clean, follow the steps.
Step 2: Scan with a bootable antivirus (Live CD)
Several antivirus vendors (Microsoft Essentials, AVG and others are mentioned in the video) offer an ISO image on their site. Download it and burn it on another computer that is not infected, then boot the sick PC from that CD, DVD or USB. That way the whole hard drive is checked without using the infected Windows, and nothing interferes with the process. If you need to boot from USB, see how to make a bootable USB.
Another option, which I do not recommend as much, is to remove the drive and connect it as a secondary disk to a healthy computer to scan it from there.
Step 3: Boot into safe mode
If you have to work from Windows, start in safe mode (or safe mode with networking if you need internet). If you can, use safe mode without networking. The msconfig tool helps you configure the startup and see what loads when the computer starts.
Step 4: Find the process in Task Manager
If the virus is still there after all of that, open Task Manager with Ctrl + Shift + Esc and look at the programs still running. When you identify the name of the virus or suspicious program, try to end it. If it will not close, write the name down on paper so you can find it and rename or delete it.
Step 5: Run System Restore, then clean the browsers
If you found and removed the viruses but the computer still does strange things, or the antivirus did not catch everything, run System Restore to go back to a point before the infection.
Chrome, Firefox or Internet Explorer often end up full of junk toolbars and extensions. Check the installed extensions in each browser and remove any you do not recognize.
Frequently asked questions
What is the safest way to scan an infected PC?
Boot from a bootable antivirus (Live CD) burned on another healthy computer, so the whole disk is scanned without using the infected Windows.
When should I format instead of cleaning?
If cleaning takes more than 30 minutes to an hour, it is better to erase and reinstall.
How do I open Task Manager?
With Ctrl + Shift + Esc. There you can see running programs and end the suspicious one.
Why should I avoid cracked programs?
Because cracks and patches often carry viruses or trojans that can steal information, for example credit card data.
Do Linux or Mac get infected?
They can get some viruses or spyware, but far fewer than Windows, which is the most attacked system.