How do I remove malware that blocks downloads?
Everyone Leo Notenboom here for Askleo.com right into the question,
I'm trying to fix a computer that has malware preventing me from getting
into regedit and task manager, it will not let me boot into safe mode.
It will not let me install any anti spyware or antivirus software.
I'm not sure where to go from here.
It has stopped me from doing much
of anything to get the malware off the computer.
Any suggestions?
Sadly, this is all too common.
It is a case where malware tries
to interfere with your attempts to remove malware.
So the problem, of course,
is that malware can sometimes go into what you might call self-preservation mode.
It tries to prevent you from getting rid of it.
And that could take many different forms
from just weird behavior to preventing you from being able to even run your anti
malware tools to preventing you from downloading anything.
There are some approaches to try and get rid of it.
We do have to get a little creative.
The first thing I recommend you do,
especially in Windows 10, is to run Windows Defender offline.
Now, it used to be a separate download
for prior versions of Windows, but in Windows 10 it's built in.
And I'm going to show you real quick how to run what they call an offline scan.
So we're going to hit the start button
here and search for surprisingly offline scan.
You can see it says virus and threat
protection system settings. Fine, that's exactly what we want.
We'll bring that up.
Click on scan options that this item here right below.
Quick scan.
And then we will change this not to a full
scan or a custom scan, but to a Microsoft defender offline scan,
what that will do and I'm going to go ahead and start it, though.
I'm not going to wait for it to finish.
What that will do is actually reboot the computer.
Out of windows and into, I believe, one of the recovery partitions that's
on your machine, when it does so, it's able to basically
run Windows Defender without the operating system running.
More importantly, it's running it without
the malware running by doing so, the malware that's trying to prevent it
self from being removed doesn't have the opportunity to do that.
So running Windows Defender offline or
Microsoft defender offline, whichever they're calling it this week,
is the very first thing I would have you do in a situation like that.
There's a very good chance, especially with the fact that
Windows security has become so much better in recent years.
It's a very good chance that it will just
take care of the issue and remove it for you.
After it's done, it'll reboot and hopefully the malware will be gone.
If that doesn't work,
the next thing to do is to what I call temporarily kill the malware.
The folks over at Bleeping Computer Dotcom have created a tool called RKill,
which actually looks for the malware running and kills it,
stops it from running, which is another way of preventing
that malware from preventing you from doing anything.
Now, there are two things of note here.
One is, yeah,
if your malware is preventing you from downloading something,
you're not going to be able to download it, at least not on that computer.
You'll want to use a different computer
probably to download it, copy it to a USB drive and then take it
over to the computer you're having problems with.
The second is that RKill has a reputation and malware may very well be looking
specifically for that name and prevent you from running anything called RKill.
So you may need to rename that file to something else
and then run something else.
Once you've run it, don't reboot
because everything it does will be undone by rebooting.
What you need to do then is immediately
run your auntie malware tools. Do a complete scan immediately after having
run RKill and see if now your scans will be able to run for one thing and second,
be able to remove the malware that you're having problems with.
The next thing I would have you try is
to download and run the free version of Malwarebytes
anti malware. Yes, there is a free version.
They push their paid version very heavily, but you can still get their free version
and run it and do what you need to do in a case like this.
So my recommendation is grab a copy
of Malwarebytes free version or the free trial and run that,
see if it can get something again because your malware is preventing you
from downloading anything you may need to download Malwarebytes on a different
machine and then take it over to the machine you're having a problem with.
Next thing, try another tool.
Now, by this, I mean
there are other tools sometimes from the anti malware tool vendors
themselves that will run from a bootable CD or DVD or a USB stick.
I don't have any listed here, but what I would have you do is to go out
to the manufacturer of whatever antivirus tool or anti malware tool you're using
and see if they don't also offer some kind of a standalone bootable version of their
tool that will do the same thing as Windows Defender Offline will do.
It'll reboot into a situation where
Windows itself is not running and then run the anti malware scan.
Look for a couple of those, see if those can't solve the problem for you.
If nothing works, nothing we've tried so far works.
There's not really a lot of other options left,
you might remove the hard disk and take it to a different machine that is working
and run anti malware scans using that other machine.
On this drive that you've taken over, probably put into an external
hard disk case, my recommendation would be to do that.
And that way you can run anti malware scans on it, you can back it up.
You can do all sorts of different things to it.
Without the software,
the malware that's on it actually running, you must be careful not to accidentally
infect the machine that you're doing this with.
But that would be I'd call it the the last resort.
The true last resort, of course,
is the nuclear option where you just throw up your hands.
You, you somehow back up the machine.
If you don't have a backup already and you
reinstall windows from scratch. That will get rid of the malware.
It'll also get rid of all your installed programs and your data.
So you will really be starting over from scratch.
Now, I do have to in full disclosure.
Make you aware of something that would have made all of this a non-issue,
and that's a backup.
If you had a full image back up
of the machine taken prior to whatever this infection happens to be,
you would simply restore that backup and get on with your life.
Really, it is that simple.
And it's one of the reasons that I harp
on backups so much because we've talked about a lot of different steps here,
a lot of different and confusing steps that may or may not even work.
A backup taken prior to your infection.
Can always be restored to take you back
to that point in time, it needs to be a full image back up
of the entire machine, but that is exactly what a full image back up is.
It's a snapshot of your machine
at a particular point in time prior to the malware having happened.
It doesn't actually get much simpler than that.
Hopefully, this was helpful.
Hopefully this might
scare you a little bit into backing up a little bit more religiously daily
perhaps would be my suggestion for updates, for related links.
For more commentary on all of this, visit Askleo.com/4686.
I'm Leo, Notenboom.
This is Askleo.com.Thanks for watching.