How to Prevent and Remove Viruses and Other Malware

What is a computer virus?A computer virus is a small software program that spreads from one computer to another and interferes with computer operation. A computer virus might corrupt or delete data on a computer, use an email program to spread the virus to other computers, or even delete everything on the hard disk. 

Computer viruses are frequently spread by attachments in email messages or by instant messaging messages. Therefore, you must never open an email attachment unless you know who sent the message or you are expecting the email attachment. Viruses can be disguised as attachments of funny images, greeting cards, or audio and video files. Computer viruses also spread through downloads on the Internet. They can be hidden in pirated software or in other files or programs that you might download. 

Symptoms of a computer virus
What is a worm?A worm is computer code that spreads without user interaction. Most worms begin as email attachments that infect a computer when they're opened. The worm scans the infected computer for files, such as address books or temporary webpages, that contain email addresses. The worm uses the addresses to send infected email messages, and frequently mimics (or spoofs) the "From" addresses in later email messages so that those infected messages seem to be from someone you know. Worms then spread automatically through email messages, networks, or operating system vulnerabilities, frequently overwhelming those systems before the cause is known. Worms aren't always destructive to computers, but they usually cause computer and network performance and stability problems. 



What is a trojan horse?A trojan horse is a malicious software program that hides inside other programs. It enters a computer hidden inside a legitimate program, such as a screen saver. Then it puts code into the operating system that enables a hacker to access the infected computer. Trojan horses do not usually spread by themselves. They are spread by viruses, worms, or downloaded software. 


What is spyware?Spyware can install on your computer without your knowledge. These programs can change your computer’s configuration or collect advertising data and personal information. Spyware can track Internet search habits and can also redirect your web browser to a different website than you intend to go to. 

What is rogue security software?A rogue security software program tries to make you think that your computer is infected by a virus and usually prompts you to download or buy a product that removes the virus. The names of these products frequently contain words like Antivirus, Shield, Security, Protection, or Fixer. This makes them sound legitimate. They frequently run right after you download them, or the next time that your computer starts. Rogue security software can prevent applications, such as Internet Explorer, from opening. Rogue security software might also display legitimate and important Windows files as infections. Typical error messages or pop-up messages might contain the following phrases: 

Warning!
Your computer is infected!
This computer is infected by spyware and adware.

Note If you receive a message in a popup dialog box that resembles this warning, press ALT + F4 on your keyboard to close the dialog box. Do not click anything inside the dialog box. If a warning, such as the one here, keeps appearing when you try to close the dialog box, it’s a good indication that the message is malicious. 

Are you sure you want to navigate from this page?
Your computer is infected! They can cause data lost and file corruption and need to be treated as soon as possible. Press CANCEL to prevent it. Return to System Security and download it to secure your PC.
Press OK to Continue or Cancel to stay on the current page.

If you see this kind of message, then don't download or buy the software. 

What is malware?Malware is a term that is used for malicious software that is designed to do damage or unwanted actions to a computer system. Examples of malware include the following:

• Viruses
• Worms
• Trojan horses
• Spyware
• Rogue security software

How to remove malware such as a virus, spyware, or rogue security softwareRemoving a computer virus or spyware can be difficult without the help of malicious software removal tools. Some computer viruses and other unwanted software reinstall themselves after the viruses and spyware are detected and removed. Fortunately, by updating the computer and by using malicious software removal tools, you can help permanently remove unwanted software. 

Note If you cannot access the Internet on your computer, use another computer to help you follow the steps in the “How to reset your Internet Explorer proxy settings” section on the computer that may be infected. 

To remove a computer virus and other malicious software, follow these steps in order. 

Install the latest updates from Microsoft UpdateNote A computer virus may prevent you from accessing the Microsoft Update website to install the latest updates. We recommend that you set the Automatic Updates service to run automatically so that a computer is not missing any important updates.Windows Vista and Windows 7

1. Click Start, and then type Windows Update in the search box.
2. In the results area, click Windows Update.
3. Click Check for Updates.
4. Follow the instructions to download and install the latest Windows Updates.

Windows XP

1. Click Start, and then click Run.
2. Type sysdm.cpl, and then press Enter.
3. Click the Automatic Updates tab, and then click the Automatic (recommended) option.
4. Click OK.

Use the free Microsoft Safety ScannerMicrosoft offers a free online tool that scans and helps remove potential threats from your computer. To perform the scan, go to the Microsoft Safety Scanner website. 

Use the Windows Malicious Software Removal Tool
Manually remove the rogue security softwareIf the rogue security software can’t be detected or removed by using Microsoft Safety Scanner or the Windows Malicious Software Removal Tool, try the following steps:

1. Note the name of the rogue security software. For this example, we'll call it XP Security Agent 2010.
2. Restart your computer.
3. When you see the computer's manufacturer's logo, repeatedly press the F8 key.
4. When you are prompted, use the arrow keys to highlight Safe Mode with Networking, and then press Enter.
5. Click Start and check whether the rogue security software appears on the Start menu. If it's not listed there, clickAll Programs and scroll to find the rogue security software's name.
6. Right-click the name of the rogue security software program, and then click Properties.
7. Click the Shortcut tab.
8. In the Properties dialog box, check the path of the rogue security software program that is listed in Target. For example, C:\Program Files\XP Security Agent 2010.
   
   Note The folder name frequently is a random number.
9. Click Open File Location.
10. In the Program Files window, click Program Files in the address bar.
11. Scroll until you find the rogue security software program folder. For example, XP Security Agent 2010.
12. Right-click the folder, and then click Delete.
13. Restart your computer.
14. Go to the Microsoft Safety Scanner website.
15. Follow the steps to run the scan and to help remove the rogue security software.

If you suspect that your computer is infected with rogue security software that was not detected by using Microsoft security solutions, you can submit samples by using the Microsoft Malware Protection Center submission form.



Install and run Microsoft Security EssentialsMicrosoft offers a free malicious removal program called Microsoft Security Essentials that helps protect your computer from becoming infected. To install Microsoft Security Essentials, follow these steps:

1. Go to the Microsoft Security Essentials website.
2. Click Free Download.
3. Click Run, and then follow the instructions to install Microsoft Security Essentials.
4. After installation, restart your computer.
5. Click Start, click All Programs, and then click Microsoft Security Essentials.
6. On the Home tab, select the Full scan option, and then click Scan now.

Install Windows Defender OfflineWindows Defender Offline is a malware tool that helps remove difficult to eliminate viruses that start before Windows starts. To use Windows Defender Offline, follow these steps:

1. On an uninfected computer.
2. Click Download the 32 bit version or Download the 64 bit version, depending on which operating system that you are running. If you're unsure of which operating system that you are running.
3. When you are prompted, click Save As, and then save the file to a DVD, CD, or USB flash drive.
4. On the infected computer, insert the DVD, CD, or USB flash drive, and then restart the computer.
5. When you are prompted, press a key to select an option to use to start your computer, such as F12, F5, or F8, depending on the kind of computer that you are using.
6. Use the arrow key to scroll to the drive where you installed Windows Defender Offline file. Windows Defender Offline starts and immediately scans for malware.

How to protect your computer against malwareThere are actions that you can take to help protect your computer against malware. 

Turn on the firewall

• For information about how to turn on your firewall in Windows 7, go to the Turn Windows 7 Firewall on or offwebsite.
• For information about how to turn on your firewall in Windows Vista, go to the Turn Windows Vista Firewall on or off website.
• For information about how to turn on your firewall in Windows XP, see the following article in the Microsoft Knowledge Base:

Keep your computer up to date
Install Microsoft Security Essentials and keep it up to date
Don’t be tricked into downloading malwareHere are some tips that can help protect you from downloading software that you don't want:

• Only download programs from websites that you trust. If you're not sure whether to trust a program that you want to download, enter the name of the program into your favorite search engine to see whether anyone else has reported that it contains spyware.
• Read all security warnings, license agreements, and privacy statements that are associated with any software that you download.
• Never click "Agree" or "OK" to close a window that you suspect might be spyware. Instead, click the red "x" in the corner of the window or press Alt + F4 on your keyboard to close a window.
• Be wary of popular "free" music and movie file-sharing programs, and make sure that you understand all the software packaged with those programs.
• Use a standard user account instead of an administrator account.

How to reset your Internet Explorer proxy settingsMalicious software might change Internet Explorer proxy settings, and these changes can prevent you from accessing Windows Update or any Microsoft Security sites. 

To have us change your Internet Explorer proxy settings for you, follow these steps:

1. On an uninfected computer, see the following article in the Microsoft Knowledge base:
2. Go to the Fix it for me section.
3. Click the Fix it button. Save the file to a flash drive or a CD when you are prompted.
4. Insert the flash drive or CD in the infected computer.
5. Start Windows, click Start, and then click Run.
6. Click Browse.
7. Select the location of the flash drive or CD. Double-click the file that you saved, and then click Open.

To change your Internet Explorer proxy settings yourself, follow these steps:

1. Click Start, and then click Run.
2. In the Run box, copy and paste the following:
   reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyEnable /t REG_DWORD /d 0 /f
3. Click OK.
4. Click Start, and then click Run.
5. In the Run box, copy and paste the following:
   reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer /f
6. Click OK.