A friend started to get alerts and warnings that it was his PC was infected with viruses. Despite best efforts to remove them using a cacophony of tools, most of which detected elements of an infection, things just didn’t seem to be quite right with the system. The most notable thing being Google Chrome wouldn’t start – even after a re-install. The final piece of the puzzle was the PC being infected with a TDSS rootkit which appears to be quite prevalant out there.
Having solved the PC woes, here’s some things that I noted as we went through the process, particularly if Google Chrome won’t start (Chrome seems particularly susceptible to infections):
- Remove the rootkit with a tool like Rootkit Revealer , Kaspersky TDSS rootkit removal tool or Sophos AntiRootkit
- Remove the virus(es) using an anti-virus tool like AVG Anti-Virus, Microsoft Security Essentials or some other reputable anti-virus tool
- Use Malwarebytes Anti-Malware and / or SuperAntiSpyware to remove spyware/malware
- Check that your system is not directing internet traffic through a malware proxy; In Windows go to “Internet Options” > “Connections” > “LAN Settings” and make sure that if the “Proxy Server” is checked that it’s something you recognise. If you don’t recognise or are not sure about it, uncheck this box.
- Check your HOST file hasn’t been altered. Go to $WINDOWS (e.g. C:\WINDOWS) > System32 > Drivers > etc – edit the “HOSTS” file. This will have an entry referring to localhost 127.0.0.1 but anything that has other website URLs may be suspect. Consider removing them.
- Check your Windows Startup; Go to Start > Run > type msconfig – Click on the “Startup” tab and check each entry – those with blank or what appear to be random text entries could be virus/malware related (e.g. TklERc01). Uncheck them as needed.
- If you want to check a file using a multitude of virus checker, try VirusTotal (http://www.virustotal.com) – this is a great little site to help understand potential threats.
Hopefully the above will help you either remove threats or avoid them. If you want to be extra-safe, try Sandboxie if you’re not confident the file you’re running is free of issue.
(Please rate / comment if this article helped you!)