Intelligent Security Solutions

Last Updated: Sunday, August 17, 2008 11:11 PM  

 

Threat Removal

 

This page will describe the Basic instructions on threat removal. This is only a basic guide, and will not work for every threat or infection.

 

  • Update the virus definitions.
  • Disable System Restore (Windows Me/XP/Vista)
  • Run a full system scan and delete all the files detected as threats.

1. Update your anti-virus program in the usual fashion associated with your specific brand.

2. Disable System Restore

(Windows Me/XP/Vista)
If you are running Windows Me or Windows XP, we recommend that you temporarily turn off System Restore. Windows Me/XP/Vista uses this feature, which is enabled by default, to restore the files on your computer in case they become damaged. If a virus, worm, or Trojan infects a computer, System Restore may back up the virus, worm, or Trojan on the computer.

Windows prevents outside programs, including antivirus programs, from modifying System Restore files. Therefore, antivirus programs or tools cannot remove threats in the System Restore folder. As a result, System Restore has the potential of restoring an infected file on your computer, even after you have cleaned the infected files from all the other locations.

Also, a virus scan may detect a threat in the System Restore folder even though you have removed the threat.

Disabling or enabling ME System Restore

A. Click Start > Settings > Control Panel.
B. Double-click the System icon.
C. On the Performance tab click File System.
D. Click the Troubleshooting tab, and then check Disable System Restore.
E. Click OK, then Yes, when you are prompted to restart Windows.
F. Proceed with your scanning.
Disabling or enabling XP System Restore

A. Right-click My Computer, and then click Properties.
B. Click the System Restore tab.
C. Check the "Turn off System Restore" or "Turn off System Restore on all drives".
D. Click Apply. The following message appears: This will delete all existing restore points. Click Yes to do this.
E. Click OK, then Yes, when you are prompted to restart Windows.
F. Proceed with your scanning.

Disabling or enabling Vista System Restore

A. Right-click Computer, and then click Properties
B. Choose System Protection
C. Uncheck all drives

 

I am providing an example below. When you select your drive, normally you'd choose the main C: drive which contains your Master Boot Record (where your Operating System files are located), but in my example I chose another for display purposes.

  • You may also choose to start your system in Safe Mode to do your scan. This option has been debated for a long time. Starting in Safe Mode prevents some critical resources from loading, which may need to be in order to be fully scanned by your anti-virus program. Yes, you can manually choose to load these files and resources, but for the sake of simplicity and overall effectiveness, I recommend you start in Normal Mode. But I will explain how to start in Safe Mode for those of you who want to manually choose which resources to start.

    Upon reboot, and depending on your computer brand, you want to continuously press 'F8', or the 'Delete' key, which will bring you to a screen with several Boot Options. You want to choose Safe Mode, then hit 'Enter'.

3. Now run a full system scan at the highest security level settings. After the scan has completed, if any threats were detected, choose to delete them all, or quarantine if delete is unsuccessful or not possible.

  • When all the infected files have been deleted or quarantined, restart the computer in Normal mode. You may at that point, go in and turn system restore back on. Simply follow the steps outlined above and choose enable this time.