How to Remove Malware
Malware refers to any software program developed for the purpose of causing
harm to a computer system. It includes viruses, trojan horses, worms, spyware,
etc. Since most of them will reinstall themselves even after you think you have
removed them, or hide themselves deep within Windows, i'll just try to help
ppl who don't know how to remove them, or just can't be bothered to find out
how. ^_^" hey, i'm no expert at this, i'm just experienced.
first, how do you know if you are infected? mostly your system will become
super slow, crashes without warning (but that could be due to other reasons,
like hard ware failure), and most obviously, you find your email or messenger
send dozens of messages without you yourself doing it.
Example: someone send you a 2-part message through msn messenger, which goes
like this:
>look at my profile
>http://myprofiles.t35.com/profile.php?email=[this is the email you used
to logon your msn messenger]
if you click the url, it will tell you to download a .exe file, with the filename
as your email. once you clicked "run", congradulations, you have just
sent the same virus/trojan that invaded your system a milisecond ago to everyone
on your msn contacts.
oops, i think i'm a bit 罗嗦 now, ok
LET THE WAR BEGIN
1. Press Ctrl-Alt-Delete (for XP users) to call up the Windows Task Manager.
Click the "Processes" tab.
Under this tab, you can see all (maybe) the processes that your system is currently
running. Namely, the .exe files. This is where you *try* to identify and stop
the virus from harming your system more. Sort the list by user name to see which
processes are under your username. You can ignore the SYSTEM and NETWORK SERVICE
processes, since you can't kill them anyway.
Scan for suspicious-looking names like zeh.exe (ok that's rather obvious) or
minor variations to known process names (for example msnmsg.exe, which is similar
to the msn messenger process, BUT IS NOT. real msn messenger has name of msnmsgr.exe).
If you are not sure, google the filename (including the .exe) and see what people
say about it. But beware, sometimes the information on the net, or even spybot,
may not be necessarily true in your case.
Some processes, like msmsgs.exe, receive conflicting viewpoints, since they
are real process names used by malware developers to confuse people. In the
case of msmsgs.exe, it is actually the Windows Messenger bundled with XP itself.
the real msmsgs.exe (under \program files\messenger\ ---- i think) is only a
useless nuisance that eats up your precious system memory, but the fake one
(under C:\windows\system32\) is a spyware/trojan/virus that's much more annoying
than the real one. Better disable Windows Messenger first, then kill that process,
even if it's not a trojan horse, and then immediately delete the whole \program
files\messenger\ directory.
2. Run Spybot,
Lavasoft Ad-Adware, and then maybe Norton Antivirus
(if you have it, it's optional) IN THE ABOVE ORDER.
The first two are well-known and widely-trusted freeware (or is it shareware?
i'm not sure) which you can download free from the sites provided above (with
NO spyware included). If you have it already, MAKE SURE THAT YOU UPDATE IT FIRST.
Spybot is especially good with its fast search and the many useful applications
it included (in Advanced mode). The "Startup Process" function is
worth tweaking with, but only if you know what you are doing. However, if you
see anything that you just killed in Step 1 here, you should DEFINATELY delete
it.
AdAdware is less useful, but still has its own specialities. It scans slower
than spybot, and eats up a lot of your system memory while scanning is taking
place, much like Norton.
Norton seems always rather slow in keeping up-to-date with the most recent
malware, so it would be best to use Noton scan last. If you have no time, you
can skip it entirely, or save it for later. I don't really trust Norton's skills
in detecting newer viruses. i spent 4 long hours doing the full system
scan, (with the latest definations, mind you) when i know i'm infected. and
all it came up with after all that time, was a few feeble outdated sample viruses
and trojans in an archive (it can't harm anything in that state). and
the funny thing is that rar file was used by my dad (he's teaching system security
at one time, so that was his sample to show what a typical malware can do.)
I've totally given up on norton.
3. Go to Start > Run. Type in "regedit" ( without the inverted
commas) and hit ok. Windows Registry Editor will come up.
Make sure that you know your enemy's name first. Literally. For example, if
you are trying to delete MSblaster, you should Ctrl-F (search) using the keyword
"blast". Be careful when you do this, however, since a wrong movement
of the finger on the DELETE key could result in you having to reinstall windows
again. Not that it's a bad thing, since reinstalling will definately give you
the cleanest system you can imagine ^_^ Some key things to look out for are
the names mentioned by spybot when it churned out its results, or the processes
on WinTaskManager that you found to be trojans.
4. Restart the system, and then repeat steps 1-3 ^_^ just to make sure that
everything is kill off.
If the same trojan you just deleted rose from the dead again, check online
forums for help.
erm... if there's anything more i can think of i'll do a follow up on this....
random note: wow this is the first time i've typed so much since the commonwealth essay 2005
