Before You Remove Malware…BACKUP!

Posted by malwarekilla
July 31, 2008

If you're new here, you may want to subscribe to my RSS feed. Thanks for visiting!

I got lazy and paid for it. Let me explain.

A friend brought me his Windows XP workstation loaded with malware. I removed the malware with SuperAntiSpyware and MalwareBytes (since he didn't want to buy any antivirus) in safemode. Once the first round of scans and removals were completed I rebooted. Bam! BSOD! Windows XP was looking for a dll, no name of course, just a dll.

Anyway in the end I had to reinstall Windows XP, very embarrassing to say the least.

So, I've created a checklist to use before I remove any malware in the future.

Follow the steps below before you remove any malware:

Backup important personal files – These files are usually located in c:\Documents and Settings\ (for Windows XP) and C:\Users\ (for Windows Vista). You may backup these files to CD\DVD or to an external hard drive.

Enable System Restore – System Restore can return your critical Windows system files to a previous point in time (when your PC was working).

Enabling system restore for Windows XP

  1. Right Click My Computer
  2. Click Properties
  3. Click the System Restore Tab
  4. Choose the hard drives that you would like system restore to monitor

Enabling system restore for Windows Vista

  1. Right Click Computer
  2. Click System Protection
  3. Under Available Disks make sure you system disk is check. This will most likely be C:\

Create A Restore Point.

Creating a Restore Point for Windows XP

  1. Click Start
  2. All Programs
  3. Accessories
  4. System Tools
  5. System Restore
  6. Select Create a Restore and then click next
  7. Give the restore a description
  8. Click Create
  9. It should say the restore point was created
  10. Click Close

Creating a Restore Point for Windows Vista

  1. Right Click Computer
  2. Click System Protection
  3. Click the Create Button
  4. Give your restore a description

Backup your registry – Even though System Restore backs up your registry it's still always a good idea to manually back it up. Follow the steps below to back up your registry.

  1. Click Start (or for Vista click the windows globe at the bottom left)
  2. All Programs
  3. Accessories
  4. Command Prompt
  5. Type Regedit and click enter
  6. Once the Registry Editor Opens click Computer
  7. Click File and then Click Export
  8. Choose a place to store the registry backup and give it a name
  9. Wait a few moments for the backup to complete.

Locate your Windows System Disc – Just in case your system files get infected with a worm you'll want to have your Windows system disc handy. You can verify the integrity of your system files by running a simple command in your command prompt. To load your command prompt:

  1. Click Start (or for Vista click the windows globe at the bottom left)
  2. All Programs
  3. Accessories
  4. Command Prompt
  5. Insert your windows system disc
  6. Type-in sfc /scannow
  7. Let the System File Check complete.

Learn how to backup your computer online

Anti-Malware HowTo, Uncategorized, ,

Did you enjoy this post? Why not leave a comment below and continue the conversation, or subscribe to my feed and get articles like this delivered automatically to your feed reader.

Comments

I’m surprised you had to do a full reinstall of XP. A repair install is _supposed_ to replace any missing system DLL’s. Any idea why that didn’t work?

Comment by Dave Miller on October 8, 2008 @ 3:54 pm

I always make an .img file of C:\WINDOWS and any documents, before doing a system restore point. If it fails, I use ERD Commander 2007 to do a system restore without needing to boot into windows. If that fails, I use an ubuntu live CD to replace the .dll

Comment by Jimmy James on November 11, 2008 @ 9:23 pm
Leave a comment

(required)

(required)