Win32 Virus Removal

A PCMag reader contacted me with a fairly serious problem. He found a gibberish-named item launched at startup from a gibberish folder that, according to Windows Explorer, held zero bytes. If he unchecked the file to keep it from launching at startup, it mysteriously re-checked itself. Clearly he had acquired some sort of polymorphic malware. I asked what sort of security protection was present.

The reader had McAfee AntiVirus Plus 2011 installed, but the malware breached its protection. That's not as uncommon as you might think. I recently ran into a threat called Tidserv that managed to install despite protection by Norton AntiVirus 2011. The victim of this latest attack felt his only recourse might be restoring the system back to its out-of-box state. That sort of full system restore can wipe out month or years of data and program installations; it's not to be undertaken lightly.

In this particular case I suggested the reader turn first to McAfee's Stinger, a focused tool specifically designed to remove tough threats. For a Norton user I would have started with Norton Power Eraser. Trend Micro's HouseCall is another possibility. All of these tools are freely available for download.

When tech support agents for some security vendors run into a problem their own product can't handle, they sometimes turn to Malwarebytes' Anti-Malware 1.46 for help with cleanup. If the real problem is that the malware fights back against removal, try a free Rescue CD that boots into a non-Windows operating system and thereby prevents the malware from running. There are many, many tools to try before you resort to wiping your PC back to its out-of-box state.