At Automated Results, we get our share of clients calling with fully infected business or home computers and they are looking for us to clean them up without losing data. Over 95% of the time we can clean up the system without having to format the drive and rebuild the operating system. Despite our lectures about having good backups, often we face infected computers with no backup available. With a 20 to 1 track record of avoiding a rebuild, our technique appears to work well. Although it is a moving target as of Feb, 2010, the following sequence works well for Windows operating systems:
1. Download the latest copy of SpyBot Search and Destroy and MalwareBytes
http://www.safer-networking.org/en/spybotsd/index.html
http://www.malwarebytes.org/
(Note: be careful to download the right product and not advertisement downloads)
2. Format a memory stick and put these two packages on the memory stick
3. Take the computer off the network
4. Reboot into Safe Mode with Networking
5. Install MalwareBytes
6. When it is ready to get updates, hook up the network and let it get the updates, then unhook
7. Run a full scan with MalwareBytes and fix the problems
8. If there are items found and repaired, then reboot to Safe Mode with networking and run again
9. Continue until either there are no items or the same items keep coming back (ex. 2 or 3 items) then install SpyBot S&D, run the registry backup, download updates, and run a full scan.
10. Reboot to Safe Mode with networking and rerun MalwareBytes first then SpyBot second.
11. When both programs come up clean following a reboot in Safe Mode, do a normal reboot.
12. Let the system sit on the network with a normal boot for a few hours to see if anything shows up
13. Try the web browser to see if any pops or odd activity occurs.
14. When normal user activity is clean for a day, you are typically safe.
It used to be that Norton Antivirus and SpyBot was good enough, however now MalwareBytes finds more than SpyBot and MalwareBytes doesn't find everything to prevent reinfection, but the combination does. Let us know if you need additional help: Spyware removal help