Support

Support => Email FAQ | Windows Hosting FAQ | Linux Hosting FAQ | Windows Dedicated Server FAQ | Linux Dedicated Server FAQ

My system has been infected. How do I remove virus / spyware from my computer?

Step 1: Get Windows Update working

If you can get it, here is an article that describes the process of getting Windows XP computer connected to the Internet without getting a virus or spyware:

http://www.sans.org/rr/whitepapers/windows/1298.php

Most of this you can skip as you are already connected to the Internet, however, they suggest you enable Windows Firewall on XP. I agree with this and suggest you follow their instructions for configuration and running Windows update.

Step 2: Scan for and clean viruses

Here are some reputable sites with free virus scanning:

http://www.clamwin.com/ (free software)

http://housecall.trendmicro.com/ (free web scan)

http://www.ravantivirus.com/scan/ (free web scan)

http://free.grisoft.com/freeweb.php/doc/2/ (free software)

http://security.symantec.com/sscv6/default.asp?langid=ie&venid=sym (free web scan)

http://us.mcafee.com/root/mfs/default.asp (free web scan)

Hopefully, one of these will work for you. If you do find a virus, you might have to download removal tools to clean them. These are usually found on the antivirus vendors web sites. Since the virus/spyware may be blocking your access to those sites, you might have to download them from another computer.

As an alternative to the above, both Norton and McAfee offer paid virus removal support. At around $40, it's really not a bad price.

Step 3: Scan for and clean spyware

The following tools are all free for non-commercial use. Ideally, you will run all of these because none of them alone (or possible even together) can get 100% of spyware:

http://www.microsoft.com/athome/security/spyware/software/default.mspx (Microsoft AntiSpyware Beta)

http://www.lavasoftusa.com/software/adaware/ (Ad-Aware SE Personal Edition)

http://www.safer-networking.org/en/download/index.html (Spybot Search and Destroy)

I don't recommend using any other spyware programs at this time... Beware: many of the other programs you see for sale are scams.

Step 4: Get software antivirus and firewall working smoothly

If you have Windows XP, the firewall included with XP Service Pack 2 is pretty good, so you don't have to buy a firewall (but it won't hurt, either). If you don't have XP, you need a firewall. I recommend installing one of the excellent inexpensive firewall routers from Linksys (BEFSR11 is a simple model), NetGear  (DG834 should work) or other big name home networking vendor.

However, even with a firewall and antispyware, you still need antivirus software (and update subscription). Many Dell systems include Norton or McAfee antivirus. If your Norton or McAfee subscription is still valid, then I would stick with it - call the vendor for installation support if it won't work or update properly. Otherwise, I would recommend one of the subscription versions of McAfee (easy to get working smoothly, but a memory hog), the excellent and no-cost ClamWin or one of the free products discussed in this article: http://www.pcworld.com/howto/article/0,aid,113462,00.asp. ClamWin works well, but I can't say how good their virus updates are. I have read good reports about Grisoft's AVG Anti-Virus System.

Step 5: Weekly maintenance

At least once a week, run Windows Update and check to make sure your virus/firewall software is downloading updates.

If your system is still running slowly and/or you still get pop-ups and redirects when you shouldn't

My kids recently had some spyware on their computer that none of the usual programs could clean up. I tried all of the "big three" programs several times with all the latest updates installed. So, I was forced to manually clean the system using low level tools. This procedure is for experts and should only be resorted to when the alternative is to format your hard drive and start over. The way I eventually got it off (I hope!) is to run StartupList and HijackThis from http://www.spywareinfo.com/~merijn/downloads.html and look at all the "unusual" programs (being an expert helps) being started in all the different ways. Anything unusual looking, I deleted. There were tons of spyware programs in C: and C:windows (and all its subfolders). In Windows Explorer I figured out how to view file Version information in Details view (add the Version column with Explorer's view settings). Most legitimate .dll or .exe files will have a version number (other kinds of files may not have version information). I found all kinds of spyware by looking for files in C: and C:windows (and all its subfolders) with missing or unusual version information.
 
One thing that is a pain on the kid's XP Home system:  Each XP user has his own Run keys in the registry. You can't see these unique keys just by logging in as Administrator. This problem will come up on any system on which you log in as Administrator to run clean up tools. It seems like the tool can clean the current user's registry keys, but it won't clean the keys of other users. Maybe you can give Administrator(s) permissions to read all user's registry keys, but I had already logged into each account on the system and manually cleaned by the time I figured out this blind spot.


 

If your question isn't answered here, ask our support team directly,
or call 678-268-4065 and choose option 2 for support.