NWA-PCUG Newsletter Article, December 2011
Langa's list of great tools to cure infections
By Fred Langa, Windows Newsletter

When your PC suffers from the same infection repeatedly, it's time for special-purpose software.

Here are 14 free tools that can help rid a PC of even the most stubbornly entrenched malware infections.

Why does this infection keep coming back?

Reader Tom's PC suffers daily infections — from the same malware.

"I keep getting the same two infections every day, and every day ZoneAlarm AV/AS puts them in quarantine. I've read that this constant reappearance can be stopped by scrubbing, erasing, or cleaning free space on the hard drive. Can you tell me how to do this?"

I'll answer your question, Tom, but I don't think it will solve your problem. If you don't mind, I'll also suggest some additional steps I think you should take.

I assume you're interested in wiping (totally erasing) your hard drive's free space in case malware is hiding there. Windows has no built-in tool for wiping free space, but there are many third-party tools that can handle the job.

Perhaps the best single-purpose tool is the free, open-source app Eraser (site). Although not meant for novices, Eraser's well-designed interface (see Figure 1) makes it relatively easy to use, and it works on all Windows versions from XP onward.

Drive-wiping Erase apps
Eraser lets you securely erase files, folders, or all the free space on your hard drive.

Another popular app, frequently recommended in Windows Secrets, is the free CCleaner (info), which offers a Wipe free space option in its Advanced settings.

Maybe a wipe will help, but I doubt it. (Only exotic malware hides in the free space.) I suspect your problem is caused by some type of nasty and persistent — but probably quite ordinary — malware. I'll bet you can find and remove it with these tools:

Rootkit removers. Rootkit malware (Wikipedia definition) can be especially hard to remove, making it seem like the infection keeps coming back. (It's not really coming back — it never left!) Given your PC's symptoms, Tom, I suggest you run one or more of the following utilities — they're specifically designed to detect and remove rootkits and all are free. (The product names are linked to each app's info page.)

Sophos' Anti-Rootkit has an excellent reputation and is easy to use.

Trend Micro's RootkitBuster targets a broad array of related threats in "hidden files, registry entries, processes, services, drivers, kernel code patches, ports, operating system service hooks, and Master Boot Record (MBR) rootkits."

Microsoft's RootkitRevealer specifically targets "Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects many persistent rootkits including AFX, Vanquish, and HackerDefender."

General-purpose malware removers. Other forms of malware also can cause the kinds of trouble you're experiencing, Tom. These additional tools may help:

Malwarebytes' Anti-Malware is an excellent, free, anti-malware utility that scans your system on whatever schedule you choose. (Windows Secrets contributors often recommend running this app on a regular basis.) The Pro version (U.S. $25) offers additional real-time protection not available in the free version.

Lavasoft's Ad-Aware comes in free, Pro ($30), and Total ($50) editions. The free version is a general anti-malware tool. The paid versions add rootkit protection and other features. (See the site for a comparison.)

Safer Networking's Spybot Search & Destroy (freeware/donationware) had fallen off my radar because it was, frankly, ancient. But the new Version 2 is now in public beta. It looks promising, but beta software is unfinished by definition and so may have flaws. Use with extra caution.

Trend Micro's Hijack This comes with several tools to help identify and remove malware. It also can generate a nicely detailed report on your system's registry and file settings, so you can look deeply for anomalies.

Trend Micro's RUBotted specifically monitors your computer for bots (short for "robot"), a common type of Internet app that can be used for malicious purposes such as allowing hackers to take control of your computer. (Check out the "Malicious purposes" section in the Wikipedia Internet-bot definition page.)

On-demand anti-malware scans. I also suggest you use one or more stand-alone, live (or on-demand) scanning services that operate independently of the other security tools on your PC. They may be able to catch malware your mainline defenses miss.

Trend Micro's HouseCall, now at version 7.1, remains one of the best in this category. (Notice how many times I've mentioned Trend Micro products? Kudos to them for offering so many excellent tools!)

Symantec's Security Check seems to do a thorough job of on-demand scanning.

ESET's Online Scanner isn't noted for its speed, but it is undeniably thorough.

Microsoft's Safety Scanner is extremely simple to use and checks for a variety of viruses and other malware.

Once your system is cleaned, Tom, don't stop! You're not done yet, because whatever you're currently using for full-time anti-malware protection isn't working properly. (If it were working, your system never would have been infected in the first place.)

I strongly suggest you look at both your current security setup and your PC use to find where the weakness is. Then take whatever steps you need to — even if it means changing security tools — to shore up your defenses.

Click here to return to top



==================================================================