NWA-PCUG Newsletter Article, May 2010
Remove Malware From Your Computer or
Face the Dire Consequences

By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host
(click to email author)

http://www.malwarebytes.org http://www.malwarebytes.org/mbam/database/mbam-rules.exe http://www.emsisoft.com/en/software/free/ http://www.superantispyware.com http://housecall.antivirus.com http://download1.emsisoft.com/a2usb.zip http://www.superantispyware.com/portablescanner.html http://www.avg.com/us-en/avg-rescue-cd

For the past few weeks I have been inundated with calls, emails, and personal visits from frustrated people who have computers badly infected with malware. All of them had popular brands of free or commercial antivirus software installed which, not surprisingly, was penetrated by the vector carrying the malware. The two most common sources of the difficult to cure infections are purloined websites and contaminated email messages. To a lesser, but not unusual extent, some of the computers I cleaned were contaminated by instant messages, posts on social networking sites, and even a few that were carried on contaminated USB flash drives.

In earlier columns, I explained that much of the new crop of malware circulating rapidly around the internet, by some accounts as many as 50,000 new threats a day, are explicitly written to penetrate contemporary antivirus software. Some recent studies showed that only about 45% of the newly released malware is even detected by the major antivirus products, allowing as much as 55% of the new malware to penetrate its defenses. I also write columns about how to protect a computer from dangerous websites using any of the several link scanner utilities (mostly free) from several security companies including AVG, Threatfire, Trend Micro, and McAfee. If any one of these utilities had been used prior to the malware infection, the user would not likely have been infected. Some of the new versions of the comprehensive internet security suites provide some protection against infestation from contaminated social network sites and USB flash drives; most of the security suites provide some protection from email borne malware, but protection from the very newest threats is often beyond the capability of many products for a period ranging from just a few hours to several days, depending on how fast the security company can detect, identify, dissect, and come up with a cure. It is then up to the user to be sure to download and install the updated signature files for his security software, unless he is using one of the few "cloud based" security products that do not require frequent updating (such as Immunet and Panda's CloudAntivirus both of which were written about in recent weeks in this column). If your security software provides for automated updates, set it to update as frequently as possible; if it requires manual updates (as do several of the free security utilities), run the update feature every hour or two. One user whose computer I recently cleaned could not understand how his computer became infected because he had one of the best free antivirus utilities installed and he updates it every week or two, whenever he thinks of it. In reality, he had no protection from the hundreds of thousands of new threats that were circulating since his last infrequent update, and it was several of these new threats that nailed his inadequately updated computer. Just remember that antivirus and other antimalware software is like a newspaper; the newspaper in the driveway this morning was really yesterday's news; the antivirus update that you ran this morning was yesterday's malware signatures, and be totally cognizant that you may have little or no protection from the thousands of new threats that evolved or were otherwise created and released since your security software was updated.

Much of the new crop of malware does not just penetrate the malware defenses provided by security software, but it also invisibly kills or otherwise neutralizes the security software, usually leaving the icon running in the system tray, even appearing to update regularly. Since the user sees the icon in place, and sees the update notices, he blissfully believes that he is protected from malware, but not just is he no longer protected, but some of the malware "phones home" and tells other miscreants that this computer is available and vulnerable; that is expressly why it is usually necessary to totally reinstall the security software on the computer after the malware is annihilated. This now unprotected computer may then be hijacked as a "zombie" to send spam email, or launch cyber attacks against other computers. Keyloggers may be installed to steal usernames and passwords, as well as credit and banking information, and sold to identity thieves. Personal information, address books, spreadsheets, tax information, and personal documents may be read and distributed by the cyber crooks for their own nefarious purposes. Businesses may find their bank accounts drained, merchandise shipped to phantom recipients, trade and client secrets stolen, and become the victim of industrial espionage; all because they did not adequately protect themselves from malware attack.

If the user with the contaminated computer can get online, then it is often easy to kill the malware, unless the malware protects itself by restricting access to the malware removal tools and websites. Popular malware detection and removal tools are the free versions of Malwarebytes (malwarebytes.org), a-squared Free (http://www.emsisoft.com/en/software/free), and SUPERAntispyware (superantispyware.com). If any of these can be downloaded, updated, and run, they will likely detect and remove the malware. A common problem is that the malware prevents access to these websites, as well as the free online scanners such as TrendMicro's Housecall (housecall.antivirus.com). Many of the malware products also insert items in the computer's registry that prevents the installed antimalware software from running. One common example is the excellent Malwarebytes, which has an executable filename of mbam.exe; some of the malware does not let mbam.exe load and run. In one case, where Malwarebytes had already been installed on the computer, I simply renamed the mbam.exe to another name (killmalware79.exe), and it ran and killed the malware that was controlling the computer.

All too often, since the computer has been totally hijacked and placed under the complete control of the malware that is infecting it, it is nearly impossible to download any antimalware software or to access the online antimalware scanners, as well as even run the software that is already on the computer. In these difficult cases it is necessary to go to "plan B" to clean the computer. I carry a USB flash drive attached to my car keychain. On it I carry the portable versions of the three antimalware utilities discussed above. a-squared Free has a version available for free download that is kept updated, and intended to be installed to a USB flash drive, and run from the USB drive without the need to install it on the computer. This program is called a-squared Emergency USB Files, and can be downloaded from download1.emsisoft.com/a2usb.zip. This file can be uncompressed and extracted to the flash drive, and run directly from it by clicking on the executable file a2free.exe. When downloaded, the signature files are fairly up to date, but as a matter of practice I manually update it from my computer regularly, such that the files on my flash drive are reasonably current. When run from the USB drive, the program is as complete as one installed on the hard drive, and has all of the same capabilities of detecting and killing malware.

I carry a second program on my USB flash drive, the free portable version of SUPERAntispyware, available for download from http://www.superantispyware.com/portablescanner.html. This scanner can be installed on a flash drive or CD by following the instructions on the website. In order to prevent the program from being blocked from running by the malware that is on the infected computer, the program name will be randomly generated. This program is excellent at detecting and removing malware.

The third program I carry on my flash drive is not currently available as a portable version. It is the very popular Malwarebytes Free version, available from Malwarebytes.org. I downloaded the file to my flash drive so I can install it on the infected computer to be cleaned, if the malware will allow it. Just to be safe, as the malware will often block the update process as well, I also frequently download the manual update files to my flash drive from malwarebytes.org/mbam/database/mbam-rules.exe. If I can install the program on the infected computer, I then run the recently downloaded mbam-rules.exe to update the program. As a matter of practice, I rename the mbam.exe to another name so the malware will not block it, and then run it to kill the malware.

I believe in redundancy, well aware that no utility is always 100% capable of detecting and removing malware, so I selectively run one of the antimalware utilities from the flash drive (usually a-squared), then another (usually SUPERAntimalware). I typically select the quick scan first to provide fast cleaning of the computer's most common places of infection, then do a deep scan, which may take a much longer time to run. If the computer appears to be cleaned, I then install and run the Malwarebytes on the target computer, leaving the Malwarebytes installed so the user can update it and rerun it as needed. After removing the malware, it is often necessary to reinstall any security software that had been present, as well as change all of the user's passwords. I also advise the user to carefully and frequently check his bank accounts and credit card websites to check for unauthorized activity.

Sometimes a computer is so badly infected that it will not run the antimalware software from the USB drive, or may not even boot at all into Windows. Fortunately, there is a good solution for that. In addition to carrying my flash drive with the antimalware software, I also carry a bootable CD with an antimalware program, as well as several other utilities. I like the free AVG Rescue CD, available for download from avg.com/us-en/avg-rescue-cd. A file is also available to create a bootable USB flash drive, although many computers will not easily boot from of a flash drive, almost every computer will boot from a CD. The downloaded file is in ISO format, which must be burned to the CD by an ISO burning utility, included in most burning suites; it cannot be simply copied to the CD. If an ISO burning utility is necessary, there are several good free ones that can be downloaded. Once properly burned to the CD, the CD is bootable, but into an operating system called Linux, not Windows. Simply boot the computer with the AVG Rescue CD, and run the Linux versions of AVG's very popular antivirus and antispyware against the hard drive on the Windows computer. The CD also includes several other utilities including a file manager, registry editor, and recovery tool. Once the AVG antivirus and antispyware has been run from the bootable CD, and the infected computer cleaned, the CD can be removed from the drive, and the computer rebooted into Windows. If Windows runs properly, then I rescan it with the utilities on my flash drive, and instruct the user to reinstall his security software.

This sounds like a lot of trouble cleaning malware off of your computer, but the risks of failing to do so may lead to a lot more trouble. The local computer stores can perform much the same tasks, but typically charge $50 to over $100 for the service. The local computer clubs often have volunteers who will perform the service for free or nominal donations on a time available basis. Be suspicious of the neighborhood self-proclaimed geek who wants to reformat your hard drive and reinstall your operating system, as you will likely lose your programs and data files, unless you have a good backup. It is rarely necessary to reformat your hard drive and reinstall your operating system to remove malware, so do not even consider doing that unless the methods above totally fail, which while possible, is unlikely.

If the user has adequate multi-level security protection in place, and practices safe computing practices, the probability of becoming a victim is small, yet since most users do not have such protections and practices in place, it is only a question of when the user will be victimized, probably sooner rather than later. It would be a good practice to download and do a frequent scan with any of the utilities mentioned above, being sure to update them before any scan. If something happens to penetrate your security, these utilities will likely detect and remove them.

To quote the grizzled desk sergeant from the old TV show "Hill Street Blues", "Be careful out there!"

Click here to return to top