Virus or trojan removal

[Guus]

This tutorial should be read as a guideline. Are you infected with a trojan or virus, or do you think you are? Follow these steps, and chances are you'll get away relatively unharmed. For those of you who are not infected but have never been in contact with a virus before, read this anyway. You'll get to know what to do, in case you would be infected anywhere in the future.

The first, probably most important tip I can give you, is this: Try to remain calm. Do not try to remove viruses while in panic. Just take your time - as long as you don't use your computer the virus probably won't do any (more) damage. Be calm, be thorough and make sure you don't miss anything. If you don't feel up to it, feel free to stop working for an hour - just leave your computer as it is, and let that heartbeat go down from your throat again.

The first thing you need to do is disjoin any network you're on. Do this physically: save all data you're currently working on (locally, if you can choose), close all applications, and pull out any network and modem cable there is on your computer.

The best thing you can do now, is to call in the help of someone who has more knowledge of computers than yourself, if someone like that is available. Removing viruses is, most of the times, not that hard, but if anything happens that is not covered by this tutorial, it's good to have someone who can take educated guesses of what to do next.

Make sure you have the latest virus definitions for your virus-scanner. If you need to be updated, use another, clean computer to download the new definitions from the Internet, save them to removable media, write-protect that media (if you're using a floppy disk: pull up the little lever in one of the corners) and update your virus scanner. After that, start a complete scan (not just executables!) of your computer.

If you find a virus or trojan, write down it's exact name and location.

Using another computer (again, yours aught to be disconnected), visit your virus scanners vendor, and search their online virus-encyclopaedia for the virus. Read everything carefully, so that you learn everything there is to know about the virus (this might give you clues as where you got it, where it is, how to prevent damage, and so on - this is invaluable information, print it on paper if you can). Finally, follow the removal instructions provided on the site.

Then, repeat everything, until you stop finding viruses. Make sure you keep regularly scanning your complete harddrive - the first week, I would suggest doing so daily.

If you lost any data, restore them from backup (you did backup your important data, didn't you?) Reinstall any programs (MS Office, for example) that have been infected. Make sure however, that you scan your backups for viruses before you restore them! If you accidentaly restore an infected backup, you're back at square one again.

"My computer doesn't have a virus scanner! What do I do?"

First, you take a large, pointy stick, and you beat yourself with it, repeatedly. Any (MS Windows running) computer these days should be running a virus scanner. Any computer -not- running a virus scanner should be considered infected, and not be trust with valuable data. Virus scanners aren't that expensive, certainly not compared to the price of a new computer. If you buy a new computer, demand one. It should be standard issue with each new machine.

If your computer has no virus-scanner, you have a few options. First, you can download a (trial version) scanner, and install that (risking further infection to your computer). Next, there are online scanners available on the web. I'm don't have any experiences with them - I can't tell you if they're any good.

Personally, I would remove the harddrive from your computer, and install it as a slave in another computer running an up-to-date virus scanner - one without valuable information. This is a reasonably safe way of cleaning your computer, but it is time consuming, and requires someone with good knowledge of computers. Do not try this yourself if you have any doubts - you risk infecting the other computer as well.

This concludes this tutorial. I would like to point you to this 'Basic Virus Survival' post by Ennis - it gives a nice insight other related aspects of virus removal and prevention.

As a conlusion: Install a virus scanner. Now. If you have one, check if it is up to date. Now. Viruses come out each day, and it's the new viruses that cause the damage. A virus scanner that has not been updated for one or two months is virtually worthless.
.

[[pHA]XeNoCiDe]

Excellent tutorial Guus, I'm sure that will help lots of people who don't know about AV software. Good job.

[khakisrule]

Guus you bum!!! I was writing a trojan tutorial!!! I was almost done when I open another window and saw this thing on the front page!! Geez, you bum. And though I like that you advocate use of a virus scanner, I find mine to be somewhat different, so I think I'm still gonna post it, I'm just so amazed that this happened. Ah well, whatcha gonna do. Nice tut though.

First, you take a large, pointy stick, and you beat yourself with it, repeatedly

lol

[neel]

It's a dutchman

[Guus]

For the record: khakisrule's tutorial, which goes deeper into trojan removal, can be found here: http://www.antionline.com/showthread...hreadid=231986