WEBSITES:
https://www.emsisoft.com/en/software/eek
https://www.virustotal.com
http://www.trendsecure.com/Info/Rescue_Disk/html/download.html
http://free.antivirus.com/us/rescue-disk/index.html (INSTRUCTIONS for Rescue Disk)
http://www.imgburn.com (free ISO file burner)
http://support.kaspersky.com/viruses/rescuedisk
http://www.avg.com/us-en/avg-rescue-cd
http://www.bitdefender.com/support/How-to-create-a-Bitdefender-Rescue-CD-627.html
http://download.bitdefender.com/rescue_cd/v2/bitdefender-rescue-cd.iso (Direct download of latest build)

I recently received a call from a regular reader of this column about a problem he was having with a pernicious piece of malware on his computer, one of the newer iterations of the infamous "FBI Ransomware" malware. In the past he had successfully utilized two of the most widely used free anti-malware utilities to clean infected computers, but now he had a really difficult to remove type of malware that had hijacked his computer. Appropriately, and based on his prior satisfactory disinfection experiences, he first used the free portable version of SuperAntiSpyware (superantispyware.com) and the free version of MalwareBytes (malwarebytes.org) to scan the computer booted in safe mode with networking (F8). Both of these products have an excellent reputation of detecting and removing malware. As he had done previously while cleaning compromised computers, he booted the computer in safe mode with networking, inserted the USB flash drive, and performed a full scan first with an updated version of MalwareBytes, followed by a full scan with the updated portable version of SuperAntiSpyware. The MalwareBytes scan detected and neutralized several trojans and other forms of malware, while the follow-up scan with SuperAntiSpyware indicated a clean computer.

Upon rebooting the computer fully into Windows, the ransomware was still in control of his computer. While unusual, it is not unknown that some malware can survive detection and removal with properly updated versions of some of the most popular and widely used anti-malware utilities. In the continuous cat-and-mouse game between cyber crooks and security software companies it is inevitable that the bad guy will frequently create new malware that will temporarily penetrate the existing security software on a computer, and evade detection by excellent quality software explicitly designed to detect and remove malware. In this particular case a build of the endemic FBI Ransomware penetrated the existing defenses on his computer, a major name brand security product, and hijacked his computer, holding it for ransom. A reasonable first response is to run one or more of the well respected and updated malware detection and removal utilities, and eradicate the problem; in this case, that contemporary build of FBI Ransomware was able to survive the assault by two of the most reliable anti-malware utilities.

While MalwareBytes and SuperAntiSpyware are both outstandingly fine products with an excellent reputation at detecting and removing malware (my personal first choices), no product is 100% effective at preventing or removing malware. While the build of malware on this particular computer was not detected or removed by the cleaning utilities, it is inevitable that a near update of these utilities will be capable of detecting and removing this specific digital threat. As unlikely as it is that these fine utilities when properly installed and updated will be unable to clean an infected computer, sometimes it is necessary to call out the "big guns" and attack the malware with some other weapons.

When simpler methods fail to detect and remove all of the malware from a badly infected computer, my first "come to guy" is the recently upgraded freeware edition of "Emsisoft Emergency Kit 3.0" (emsisoft.com/en/software/eek). This Emergency Kit 3.0 is a large 225mb download that is intended to be run from a USB flash drive. The file is downloaded in ZIP (compressed) format, and then "unzipped" (uncompressed) to a flash drive. A zip file can be uncompressed with the Windows Explorer (file manager) incorporated in all versions of Windows since XP, or any one of the many third party file compression utilities can perform this simple function. Once uncompressed on the flash drive, the protocol is to first boot the computer into "Safe Mode with Networking" by turning on the computer (cold boot) and immediately tapping the F8 key every few seconds until the safe mode menu screen appears; highlight the selection "Safe Mode with Networking", hit enter, and the computer will boot into safe mode, only loading the minimal necessary drivers and programs. Do not be shocked if the screen looks unusual with very large icons, as the default screen is at low resolution. If you are offered a choice to restore the computer to an earlier time, do not do it! Also if a window opens offering a help menu, simply exit that screen; all you want is a basic desktop screen. Insert the flash drive (it may take a few moments for the computer to recognize it), and open your file manager by clicking on the computer icon or the Windows Explorer (file manager) icon. Select the flash drive letter which will open the flash drive. There may be a "Start" item displayed, which may be used to open the Emsisoft menu, or click on the RUN file folder on the flash drive, and then open "a2emergencykit.exe".

The Emergency Kit program will load offering the user a few choices; if given the opportunity to check for updates, and there is a good internet connection, then update the data files. Emsisoft releases several large signature files every day, and updating the files will make it more likely that the Emergency Kit will be able to satisfactorily resolve the malware infestation. The Emsisoft malware library contains over 10 million malware digital signatures, with maybe thousands of new signatures added every few hours of every day. This Emergency Kit utilizes a dual scan technology, basically using two different scan engines to detect and remove malware. If malware is found my personal recommendation is to quarantine what is found, which will render the malware inert without actually deleting it. My rationale for quarantine rather than delete is that the Emergency Kit is so powerful and comprehensive that in my experience it has detected a few false positives which, if deleted, could adversely impact the performance and function of some of the software on the computer. If I suspect that any file detected as malware is a false positive, I upload the questionable file to VirusTotal (virustotal.com). VirusTotal scans the questioned file with dozens of different scan engines, and displays the detailed results of the multiple scans; if most of the scan engines report that the file is clean, it likely is clean and safe, and may be restored from quarantine; if most indicate that it is malware, then the file is likely safe to delete. In my experience with Emsisoft Emergency Kit, I have found it extremely competent and thorough at detecting malware of all types; the downside of this kit is that since the malware database is so large, and since it is using a dual scan technology, it is among the slowest of scanners. The slow scan speed, as well as its sensitivity (both a positive and negative feature) and occasional reporting of false positives, is why I choose to use the more traditional malware scanners as my primary choices; but if they fail, then this Emsisoft Emergency Kit becomes my first choice malware detector and killer.

Sometimes malware files are so seriously embedded in a system that the traditional Windows based utilities cannot detect and remove them. Some of the most ruthless forms of malware hide in almost inaccessible places on a hard drive, or in protected files that are a part of the Windows operating system. Since these files are loaded when Windows boots, they are somewhat "locked" or otherwise protected by the operating system when loaded, which also protects their malware content. Another form of malware hides in the deepest spots in the hard drive, not typically accessible when Windows is loaded; when any of these scenarios occur, it may be necessary to scan the computer without Windows being loaded at all. For this purpose, many of the leading security software publishers offer a large downloadable file that can be properly burned to a CD or DVD disc, making it bootable from the disc which contains its own operating system, rather than loading Windows from the hard drive.

TrendMicro offers its "Trend Micro Rescue Disk" for download from trendsecure.com/Info/Rescue_Disk/html/download.html. Once downloaded, by following the on screen instructions, this file can create a bootable CD, DVD, or bootable flash drive with its own operating system as well as an updated version of the TrendMicro scan engine. My recommendation is to create a bootable CD or DVD disk, rather than a bootable USB flash drive as virtually all contemporary Windows computers can easily boot from a CD or DVD, but many cannot easily boot from a USB flash drive. To make almost any Windows computer bootable from a CD or DVD (this applies to any bootable CD or DVD, not just this TrendMicro disc) TrendMicro gives these instructions: "1. Insert the disc or USB drive into the computer. 2. Restart the computer. 3. When the computer powers up again, look for a BIOS setup message, which often looks like “Press [KEY] to run Setup” where [KEY] might be Delete, ESC, or one of the F1–F12 keys. 4. Once the BIOS Setup Utility has opened, look for a tab labeled Boot, Boot Order, or Boot Options." Set the CD or DVD drive (or bootable USB flash drive, if listed) as the first boot device. Once completed, save and exit; the computer will now boot from the disc or flash drive. Without a disc in the drive, the computer will boot normally from its hard drive. Once the computer is booted with the Rescue Disk, follow the onscreen prompts and menu to scan the computer from malware. Since the hard drive is not used to boot the infected computer, and a compatible operating system other than the built in Windows is loaded, any hidden malware or compromised system files now become accessible to the malware scanner.

In addition to the TrendMicro Rescue Disk, several other excellent security software publishers offer a similar bootable disc that will load its own operating system and scan for malware. These publishers include BitDefender, Kaspersky, and AVG. All of them offer a free downloadable file, that is reasonably up to date when downloaded, and may also offer the opportunity for a "soft" update when loaded, and internet access is available. These rescue disks are downloaded in ISO format which requires a third party utility to properly burn them to a disc; simply burning these ISO files to a disc like any other files will simply not work as a bootable disc. I recommend the free ImgBurn software (imgburn.com/index.php?act=download) for creating a bootable disc from an ISO file.

The Kaspersky Rescue Disk 10 is available for download (free) as a 264mb ISO file from support.kaspersky.com/viruses/rescuedisk. Click on the "Product Info" tab for direct download, and "Knowledge Base" for additional information and assistance. According to Kaspersky, " Kaspersky Rescue Disk 10 is designed to scan and disinfect x86 and x64-compatible computers that have been infected. The application should be used when the infection is at such level that it is impossible to disinfect the computer using anti-virus applications or malware removal utilities running under the operating system. In this case, disinfection is more efficient because malware programs do not gain control when the operating system is being loaded."

AVG offers its AVG Rescue CD, which it calls, " ... a comprehensive toolkit that will repair system crashes and return systems to a state where they can operate at full capacity, thanks to deep-rooted infections having been removed and file systems repaired." The AVG Rescue software is available for free as an ISO file to create a bootable CD, or in ZIP compression format to create a bootable USB flash drive. The ISO file requires the use of an ISO burning program such as the ImgBurn mentioned above. AVG Rescue CD is available for download from avg.com/us-en/avg-rescue-cd. The ISO file is an 84mb download, and the USB version is a 95mb zip file.

BitDefender offers an ISO file, the latest build of its free rescue CD, as a direct 360mb download from download.bitdefender.com/rescue_cd/v2/bitdefender-rescue-cd.iso . This ISO file is fully up to date when downloaded, and requires a utility such as ImgBurn to create the bootable CD from the ISO file. Instructions on how to create the bootable CD are available from bitdefender.com/support/How-to-create-a-Bitdefender-Rescue-CD-627.html. Also at this same location are detailed instructions on how to use the ISO file to create a bootable USB flash drive.

With a comprehensive selection of anti-malware detection and removal utilities such as those listed above, any PC user should be able to clean the most heavily malware infested computer. While it may take some time and effort to download and install the utilities, and to possibly burn a CD or make a bootable USB flash drive, the results will be well worth the effort.