How to clean a malware-infected Windows machine
This article lists some guidelines on how to fix malware-infected Windows computers
Problem
Malware is malicious software that is used to gain control of a device, often to surveil someone’s actions on their device or to otherwise compromise a device or account.
Surveillance methods can include recording keystrokes, stealing passwords, taking screenshots, recording audio or video, and more. While most malware is designed for and utilized by criminals, state-sponsored actors have increasingly adopted malware as a tool for surveillance, espionage and sabotage.
Malware can also be used to send out spam, seize banking, email or social media credentials, shut down websites, and collect vital information from journalists, human rights defenders, NGOs, activists, and bloggers. Malware can destroy, damage, or infect the information in a computer, including data on external drives. It can also take control of a computer and use it to attack other computers.
Solution
Please note that the guides listed in this article may only apply to general cases of malware infection, but may not be applicable to some circumstances. For the full workflow we should follow when suspecting a malware infection, a must-read article is Article #258: Advanced Threats Triage Workflow.
Initial assessment
When the client suspects their Windows machine is infected, we should ask them to describe the symptoms to make sure that there are clear indicators of compromise, and confirm that what they’re experiencing is not due to other causes (e.g. account hijacking).
Possible indicators of compromise:
- The client opened an attachment or link that they think may have been malicious
- The client’s webcam LED turns on when they are not using the webcam
- The client’s accounts have been compromised multiple times, even after they changed the password
Other reasons to suspect the client’s device is infected with malware can be:
- The client’s device was seized and then returned
- Someone broke into the client’s home or office and may have tampered with devices
- Some of the client’s confidential data has been made public, and it could only have come from their personal or work computer
- The client’s group is being targeted by a government, law enforcement, or an actor with equivalent capabilities
Also see the Digital First Aid Kit’s “My device is acting suspiciously” workflow.
Malware analysis
After confirming that the client is not a victim of account hijacking and there are clear indicators of compromise, if we suspect the malware is targeted, we should ask for the client’s permission to gather data necessary for malware analysis before we start the cleanup process.
We should explain that an analysis would help us find out what has happened and whether someone is targeting them, which might help them gain understanding of their adversary, their technical capabilities, and whether or not the potential attacker is known to use internet surveillance technology.
If the client is willing to wait for us to run malware analysis before the cleanup, follow the instructions in Article #258: Advanced Threats Triage Workflow for initiating a malware analysis.
Also see Security Without Borders’ Guide to Quick Forensics.
Clean the device
There are several approaches to deal with computers infected with malware, depending on the level of infection.
Important notes before proceeding:
- Before performing any removal process, ensure to back up all important data. Do not back up any system files, programs (.exe), or screen savers (.scr) because they may be infected with malware.
- Make sure the antivirus software the client is using is up to date.
- During the scan, the computer should not be used for other activities.
- Recommend that the client not run more than one scan at a time.
- If a virus is detected, instruct the client to take a screenshot of the message and send it to us through an encrypted message before they proceed with the removal of the malware.
Antivirus software
Antivirus software can be an effective first response to protecting a device from a significant percentage of malware. However, antivirus software is generally considered ineffective against targeted attacks, especially by state-sponsored actors. Nevertheless, it remains a valuable defensive tool against non-targeted, but still dangerous, malware. Below is a non-exhaustive list of options:
- The default choice for Windows 8 to 11 is the built-in antivirus, Windows Defender.
- Instructions for running a scan with Windows Defender can be found here.
- Microsoft no longer provides support for Windows 7 and older versions. For more information, check Microsoft’s Windows 7 end-of-life support article.
Other antiviruses that can be used on Windows are:
For adware
Also see Article #134: Removing adware from a Windows machine.
This NY Times Wirecutter article explains in more detail why Malwarebytes is a good choice.
Advanced malware removal
For some types of malware, like rootkits or targeted spyware, antivirus software is often ineffective, but if the malware is known there are some tools we can use to detect it.
- On Windows, the default choice is Windows Defender Offline, which runs from a trusted environment, without starting the infected operating system. Instructions for Windows 7 and 10 can be found here.
Alternative tools:
- To detect a rootkit, we can use TDSSKiller
- To detect other kinds of malware we can use Malwarebytes Anti-Malware, or HitmanPro.
In some cases, the only way to recover from malware infection is to reformat and reinstall Windows.
Sometimes, a damaged operating system can still be recovered using Windows RE:
In some instances, Windows can be restored to its previous healthy state (you must be extra careful when choosing a trusted and clean restore point) using Windows System Restore.
Important: do not perform System Restore if you’re not sure which restore point can be used.
Bootable external devices for malware removal
Consider using a bootable CD/USB/DVD for the scan, especially in the following situations:
- You cannot scan the computer using standard antivirus software because the antivirus was corrupted, and the infection won’t allow you to repair or install new antivirus software.
- Running an antivirus within Windows allows the malware to interact with the antivirus program, and makes it more difficult to successfully remove the malware.
- Booting to Windows is not possible because malware has already damaged system files required to boot.
Antivirus vendors normally provide recovery tools or rescue disks. These are software images that can be burned onto a CD/USB/DVD and make it bootable. Booting from any of these devices will allow you to run scans.
- On Windows, the default choice is Windows Defender Offline, which runs from a trusted environment without booting the infected operating system. Instructions for Windows 7 and 10 can be found here.
The following link can serve as a guide for creating a recovery tool or rescue disk:
Another option is to scan the PC using a Linux Live CD or USB stick. This requires that you install a Linux live distribution on a CD or USB stick. You can use any Linux distributions, for example Ubuntu or Linux Mint.
Instructions for creating a bootable USB stick:
- How to install a bootable CD/DVD/BD image to a USB flash drive on Debian
- Create a bootable USB stick on Ubuntu
- Create a bootable USB stick on Windows
- Create a bootable USB stick on Mac OS
Once you have booted Linux from your bootable CD or USB, you can install antivirus software like ClamAV for Linux and scan the drive.
-
Instructions for Ubuntu with ClamAV can be found in this tutorial
-
Other scanning techniques that can be applied from outside Windows are described in this guide.
These other techniques include scanning from safe mode, or removing the hard drive to scan from a different PC. This guide also contains detailed information on how to use an antivirus bootable rescue disc and on how to scan a Windows system from a Linux live CD.
Things to consider after the removal process
- Remove Temporary Files. For this purpose, we can use CCleaner.
- Recommend that the client change all passwords on their computer.
- Clean up System Restore. Restore points can be infected with malware.
Perform Additional steps as necessary:
- Check Windows Update settings - this must be set to “Automatic.”
- Check for new OS updates and install as necessary.
- Ensure that Windows Firewall is turned on; inbound and outbound rules should be properly set up.
- Ensure that Windows Defender is turned on and up-to-date.
- Ensure that User Account Control is enabled.
- Check Windows startup and log-on scripts, and remove suspicious scripts.
- Remove unnecessary programs listed on Windows startup (using msconfig.exe).
- Check Windows Action Center to make sure that no issues are detected.
- Ensure that installed third-party software is up-to-date.
- Ensure that working antivirus software is installed and has up-to-date virus definitions.
- Provide the client with recommendations on how to limit the risk of new attacks following the Security in a Box guide on malware and phishing.