I finally got off my lazy game playing butt and got back to making some videos. This video starts the Kaspersky Internet Security 2011 review and tests.
In this video you will see how the KIS/KAV install disc can double as a bootable anti-virus disc that can detect, remove and disinfect any kind of malware. Check it out!
How To Remove Any Malware for Free Guide – Updated for 2013
Removing malware from Windows can be a frustrating process for someone who doesn’t work with malware on a daily basis (like myself). Most people will just hire someone to remove the malware for them and that’s fine. In fact, I’m available for hire if you can’t follow this guide or just don’t have time to.
This guide below will show you how to remove any malware for free. If you don’t have time to read through this guide then please watch the step-by-step video below.
Removal Guide Overview
Backup – How to backup up your important personal documents just in-case your PC become inaccessible.
Gathering the needed software for this guide.
Bootable Antivirus – Why bootable antivirus is the best way to remove malware.
Bootable Antivirus Disc – How to create a bootable antivirus disc.
Bootable Antivirus Disc – How to scan your PC with a bootable antivirus disc.
Cleanup – Round up the remnants and remove them.
Prevent it from happening again.
Step 1 – Backup
If you’re able to login to your pc you should backup your documents to external media. This could be a flash drive (usb stick), external hard drive or cd/dvd. If you don’t know how to backup your documents then watch the video version of this guide above.
Step 2 – Gathering the Software Needed for this Guide
Download Hitman Pro (if you have a 32 bit version of Windows then download the 32 bit version of Hitman Pro) – Another on-demand anti-malware scanner that is able to detect rootkits and successfully remove them. It’s free for 30 days.
Download CCleaner - Cleans up all your temp files in seconds. It’s free.
Step’s 3 and 4
So, why are we going to use a bootable anti-malware (anti-virus) disc to start cleaning our pc? Simple. Disinfecting and removing malware from a bootable environment (like Linux) is effective and simple.
For example, you can tell the bootable anti-malware disc to scan your entire PC and walkway. At the end of the scan you’ll be presented with a list of files that are infected and suggested methods of dealing with them (like disinfect, quarantine, rename, delete, etc).
Creating your bootable anti-malware disc is pretty easy.
Follow these steps below. Depending on how infected your computer is you may need to perform these steps from another PC.
If you haven’t downloaded the software needed for this guide then you’ll need to download the Kaspersky Rescue Disk from here now. This is an .iso file. This iso file will be burned with a free program called imgburn. Imgburn converts this ISO into a bootable disc.
Once your ISO has downloaded we need to burn it with Imgburn.
Open ImgBurn and then click the Write Image File to Disc button.
Click “browse for a file” and then choose the Kaspersky rescue disc iso you just downloaded (kav_rescue_10.iso). Click the write button at the bottom. The burn process should only take about 10-20 minutes.
Now that the disc has been burned/created it’s ready for you to use it as a boot disk.
Booting and Scanning your Infected Computer with the Kaspersky Rescue Disk
Put the CD/DVD you just burned with ImgBurn in your CD\DVD drive.
Now it’s time to boot your PC to the disc in your CD\DVD drive. This process is different for all computers.
Shut down your PC.
Click the power button on your PC.
Now you need to select a boot device that contains your Kaspersky Rescue Disc (your CD\DVD-ROM). On Dells, for example, you could do this by tapping the F12 key as the computer starts and then using the arrows on your keyboard to select the CD\DVD drive and then press enter. Selecting your boot device options will depend on your computer type and manufacturer, please do a search on how to access your boot device options.
As the Kaspersky Rescue Disc loads please just click enter and accept any default options. You should see something like the screen below once the Kaspersky rescue disc has finished loading:
Click “My Update Center” and then click “Start update”.
Click the “Objects Scan” tab and then select “Disk Boot Sectors”, ”Hidden Startup Objects” and C:
Then click the “Start Objects Scan” button.
At the end of the scan (which could take minutes or hours) you’ll be present with a list of options concerning any infections. You should disinfect first (if this option is available), quarantine next and delete third. Always try to disinfect any infections found.
After all infections have been cleaned/dealt with you can restart your computer.
Cleaning up the Remnants
Now that all the hardcore infections have been destroyed via the Kaspersky Rescue Disc we can begin the process of getting rid of any remnants left behind.
CCleaner: CCleaner can remove thousands of temp (junk) files in seconds, thus drastically speeding up scans from Malwarebytes, Hitman Pro and your resident antivirus.
Install CCleaner. You can uncheck any included toolbars.
When CCleaner starts you can say yes to intelligent cookie scanning.
Click Run Cleaner. CCleaner will delete all temp files for the currently logged in user.
Malwarebytes:
Install Malwarebytes using the default installation options and let it completely update.
Run a complete scan of your PC. If you don’t have a lot of time then a quick scan is usually more than enough.
Remove any malicious items found.
Reboot.
Hitman Pro:
Double-click Hitman Pro to open it.
Click Next.
Accept the license agreement and click Next
Select the second option “No, I only want to perform…”
Click Next. Hitman will scan your PC.
If any threats are found (probably not at this point) Hitman Pro will allow you to activate a 30 day trial license and will remove the malware. Click Next.
Reboot.
Closing Notes
At this point your PC should be totally malware free. If you would like to prevent this from happening again then read my malware prevention guide.
Since I’m getting ready to review Comodo 4 Internet Security I thought I’d post what the changes/new features are:
Whats New in COMODO Internet Security 4.0.135239.742?
NEW! Seamless livePCsupport Integration
This version has a built-in Live Support for getting instant help from the experts for any type of problems. NEW! New User Interface Theme
A new user interface theme has been introduced with this version. NEW! New Web Based Installer
Now, there is a single setup file which downloads and installs the required products according to operating system the computer has. The product installers are created with Microsoft Windows Installer for native installation/uninstallation support. NEW! Integrated Sandbox
Proactive Defense i.e. Defense+ now includes a built-in sandbox which combines file system/registry virtualization and least-privileged user account principle in order to combat with unknown malware. IMPROVED! Default Deny Protection
Defense+ now automatically sandboxes all unknown applications/executables until they are analyzed. IMPROVED! Significantly fewer number of popup alerts
Defense+, with the help of new sandboxing technologies, has a more powerful default security policy while having significantly fewer number of alerts compared to previous versions.
Also in this version, Defense+ and Firewall, by default, do not create automatic rules for already known safe applications. IMPROVED! Popup alerts layout
The new popup alerts now include additional options which allow the users to take COMODO Time Machine snapshots or set Windows system restore points, submit suspicious files for immediate analysis. IMPROVED! Antivirus Engine
Antivirus engine is improved for better detection and cleaning. The new engine now has disinfection support for the infected files.
A new command line virus scanner (cavscan.exe) has been introduced in order to address the need for scanning the computers in windows safe mode or scanning files transferred from MSN etc.
My Comodo 4 Internet Security review and test structure:
cover some of the new features (sandbox demo)
pit comodo against 10 zero-day threats (non-sandboxed)
Since Jan 1 massive amounts of TDSS rootkits (I should call them packages because it’s more than a rootkit) have been surfacing everywhere and I’ve been swamped with calls. …good thing for me, bad for them
Anyway, here is how I’m removing and cleaning up the latest TDSS infection.
When I get to the clients house I just assume they’ve been infected with a TDSS rootkit. 80% of the time I’m right.
I immediately reboot their PC to my UBCD4Win. My UBCD4Win contains SAS, Avira (if I need it) and Dr. Web’s CureIT.
In the UBCD4WIN bootable environment I’ll load EZ-PC-Fix, load Hives (basically just loads the host’s registry so I can edit it) and delete all temp files as well as Windows System Restore files. Next, load Dr Web and scan C:\Windows\System32.
Dr. Web usually finds an infected atapi.sys (the rootkit) and asks me to move it (a.k.a – delete it).
Now it’s time to clean up.
I replace the deleted atapi.sys with a clean one from the proper OS.
I load EZ-PC-FIX (on the desktop). Load Hives.
Start Regedit. Expand HKLM on C: (not the bootable cd’s HKLM). Go to HKLM-Software-Microsoft-Windows NT-CurrentVersion-WinLogon.
Inside the WinLogon key you NEED to have string name of Userinit and a value of C:\windows\system32\userinit.exe, (don’t forget to add the comma). Close regedit. Close Ez-PC-Fix.
Locate a clean copy of userinit.exe, copy it. Open C:\Windows\System32 and rename the old userinit.exe to userinit.exe.old. Paste userinit.exe (the clean copy) to c:\windows\system32\userinit.exe.
Run a SAS scan on:
C:\Documents and Settings (for XP) or C:\Users (Vista), C:\Windows and the Registry.
Run a full Avira scan.
Reboot.
Encourage the client to choose either free anti-virus (Microsoft Security Essentials) or if they have the money for complete protection: Kaspersky Internet Security 2010.
Make sure the client is running a current browser (IE8) and that Windows updates are being installed.
If you have your own personal experience with TDSS I’d like to hear about.
Since I’ve finally had some down time I decided to work on my next review: Norton Internet Security 2010.
Here’s a tiny sneak peak on one of my “gripes” with NIS 2010 and plenty of other security applications. Rogue Antivius! Internet security suites seem to be helpless when trying to identify rogue security applications. While not exactly malicious to your operating system they are very malicious to your wallet and identity.
Here’s an example.
I installed NIS 2010 and performed all the live updates. Right after that I went on the search for some rogue antivirus. After finding a fake codec site I clicked on the codec download and installed it. NIS immediately says that the file is new and has never been seen in the Norton community, nor does it have a digital signature….but…the file is allowed to install itself on the PC and run!!!
I’m not sure why NIS 2010 allows untrusted files to install and run nor could I find anything on their forums (or help files) that explains why untrusted files are allowed to run.
What NIS 2010 (and other security applications need)
If a file or process is untrusted an average user should have an easy to use applet that allows them to terminate the process or file and then quarantine it.
Let’s take a look at the screen shots below:
The first one shows that a Rogue antivirus called SoftSafeness is untrusted by NIS 2010 yet it’s allowed to run along with all of its scareware components.
The next screen shot shows how easy it is to load the rogues payment site and Norton says it’s a safesite…ouch…someone’s going to lose their identity.
Looks like Avast 5 will be released in 3 flavors (and yes, the beta is out)
Free Version
Pro (paid) Version
Internet Security Version (paid)
Upgrades at a glance:
pro features virtualization module (for analyzing binaries in a virtual environment)
AntiSpam and Firewall Modules
big improvements on system speed (especially startup times)
the UI has really been overhauled and looks flat out sexy
Get the beta now and try it out for yourself. Be sure to report any bugs to them though! Oh yeah, I’m going to do a video on the Avast 5 beta, but I’ll not be passing any judgment since this is just a beta.