Official Malware Removal Guide by: cuddlychops06 for /techsupport // Updated: March 9, 2020. Changelog: 9/20/17 - Updated some screenshots, removed JRT recommendation Changelog: 3/09/20 - Updated screenshots, procedures, URLs, suggestions to be current If you suspect you are infected with any form of malware that encrypts your files, DO NOT follow this guide! Please make a post instead. Your files are at stake.
Windows 7 and below is no longer supported by Microsoft and UNSAFE to use. If you are still running Windows 7 with a LEGIT license, you can obtain a free upgrade to Windows 10 by using the Windows 10 Upgrade Assistant
from Microsoft. They have been very generous in continuing to allow users to upgrade from Windows 7 at no charge. Do this upgrade AFTER your system has been cleaned of malware. A system image backup is highly recommended before starting this process. This backup can be performed to an external hard drive with the Backup & Restore tool located in the Control Panel on Windows 7 and up. Purpose & Scope of this Guide:
This guide is designed to assist you in removing malware from an infected system that successfully boots
. If your computer is completely unable to boot due to malware, please make a post, as this guide will not help you. If you perform the following steps exactly as described, this will solve your problem in over 90% of scenarios. That said, not all malware is created equal, and not all malware removal tools are created equal. The tools recommended in this guide were picked because of their high success and low failure rates, measured on a very large scale. However, there will be times that this guide fails in removing malware. If that is the case, please make a post for further assistance, stating that this guide was unsuccessful. It is recommended to only accept advice from a “Trusted” technician. I am writing this guide in layman’s terms so that most people will be able to understand it with ease. Disclaimer:
The following instructions are recommendations only. You take full responsibility for any steps you choose to perform on your computer. While the following recommendations are performed without issue on countless machines, there is always a risk of damaging your Operating System or experiencing data loss on any machine. It is solely YOUR responsibility to save all work and back up any and all important data on your system before proceeding. Malware Remediation Steps: Before proceeding, go into your browser’s extensions and remove all suspicious items. Also go into your browser’s settings and remove any default search providers and unusual homepages. If you are unsure how to do this, proceed to Step 1. Download and run the following tools in this order. Run all tools unless otherwise instructed. All tools should be run in Normal Mode (not Safe Mode) unless you are unable to boot Normal Mode, or the scans fail in Normal Mode. All tools must be run under an Administrator account. Do not remove any tool-generated logs in the event a helper needs you to post them to further assist you. 1) Run rkill.com. Sometimes it takes a few minutes to finish. Do not reboot when done.
2) Download an updated copy Malwarebytes 4.0. Turn on the “Scan for Rootkits” option. Then, run a “Scan”
- Kills running malicious processes
- Removes policies in the registry that prevent normal OS operation
- Repairs file extension hijacks
3) Run Malwarebytes ADWCleaner 8 using the “Scan Now” button.
- Successfully removes the vast majority of infections
- Has an industry-leading, lightning fast scanning & heuristics engine
- Has built-in repair tools to fix damage done by malware
Optional, Advanced Step (only run if previous tools fail to solve problem): 4) Run Sophos HitmanPro
- Removes majority of adware, PuPs, Toolbars, and Browser hijacks
- Scans for bloatware & pre-installed sofware and lets you quarantine any or all of it.
- Fixes proxy settings changed by malware
- Removes certain non-default browser settings
HitmanPro is a phenomenal "second-opinion" malware scanner. I recommend clicking "Settings" and uncheck "Scan for tracking cookies" before starting the scan. This will drastically reduce scan times. This tool can only be run ONCE for free. Use it wisely. Please note:
If malware has prohibited you from browsing the web or downloading files, you can try running the NetAdapter Repair Tool
with all options checked
which will attempt to restore your internet connection & default browser settings. You may have to download these tools on another computer and move them to a flash drive that you can plug into the infected machine. Think your Mac is infected?
Try Malwarebytes Anti-Malware for Mac
. Please make a post if it is unsuccessful.
If you have run all of the above tools successfully, you should be malware-free. If you are still experiencing problems, please make a post in /techsupport
for further assistance. Follow-up Steps (highly recommended):
What is malware? Malware
- Using a computer that has not been infected, change passwords to all your online accounts.
- Consider enabling two-factor authentication on all accounts!
- Install a better anti-virus. See recommendations below.
is an umbrella term used to refer to a variety of forms of hostile or intrusive software, including computer viruses, worms, trojan horses, ransomware, spyware, adware, scareware, and other malicious programs. It can take the form of executable code, scripts, active content, and other software. [Source: Wikipedia.com] How did I get infected?
It is difficult to track down the source of an infection. Most infections are actually given permission to run unknowingly by the user. It is recommended to keep User Account Control turned on and never give access to something you do not trust or did not open. Many other infections come via exploits in your browser or browser plug-ins on websites you visit. Always be very careful what you install. Make sure you trust the source implicitly. When downloading programs, always use the publisher’s website directly. How to prevent future infections:
Be very careful what you download and install. Keep your software up-to-date. Using Ninite
for installing/updating software is very easy & safe and uses official installers without adding extra software to your PC during installation. Make sure Windows is kept up-to-date as well, including Windows 10 feature updates. Many Windows updates patch exploits and vulnerabilities in your operating system. Most infections are active because the user has unknowingly given it Administrative permission to install and run. The first line of defense starts with you. The following tools will aide you in keeping your computer clean: Free Anti-Virus Suggestions:
Free AVs will only go so far. I highly recommend purchasing the AV of your choice to get better protection. Companies who offer products for free are usually making money off you one way or another. This has been proven again recently with Avast
. If you use Avast, uninstall it immediately. Helpful Tools: