Help, I think I've installed a virus

September 9, 2013 6:39 PM

Setting up a new computer for my mother and stepfather I've accidentally installed a virus. After three hours of slogging through getting a new computer set up for them (why would we write down any of our passwords, the old now dead computer had them all saved) I tired and not paying attention downloaded Firefox for them. Problem: It wasn't from Mozilla, didn't realize until afterward that it was from something called ez-download. Internet says this is a Trojan. I've turned off the wifi and have windows defender running a scan. There is nothing on this computer from a software standpoint that needs to be saved. Computer didn't come with a windows8 disc but rather a partioned drive. If I run a reset to factory will that be easiest? Will it work? Halp!
posted by dismitree to Computers & Internet (13 answers total)

Try running System Restore to a time before the Firefox download.
posted by weapons-grade pandemonium at 6:54 PM on September 9, 2013

And then, install malwarebytes free for pete's sake!
posted by Lynsey at 6:56 PM on September 9, 2013 [1 favorite]

Best answer: Getting into Safe Mode is really convoluted on Windows 8, but run the stuff from my profile if you can. To pare it down, do a scan with ComboFix, Microsoft Safety Scanner, MalwareBytes.
posted by deezil at 6:59 PM on September 9, 2013 [5 favorites]

In these cases, I always run Windows Defender Offline, typically from booting off a USB stick. There are too many things a running malware process can do to interfere with scanners trying to detect and/or remove them, and Safe Mode has not always been a bar to them. Of course, build the scan stick from a known uninfected computer!
posted by JHarris at 9:02 PM on September 9, 2013

(I made a post to the Blue a couple years back with several offline scanning solutions.)
posted by JHarris at 9:04 PM on September 9, 2013

Windows Defender doesn't exist for Windows 8. Windows 8 has Microsoft Security Essentials built in instead. Go with what deezil's profile says.

Once you're back to virus-free state, use Ninite to install the rest of the programs you'll need. It lets you pick what programs you need and then lets you download and install them all in one go.

There's no room for "whoops, I clicked the wrong thing and now I have viruses" mistakes.
posted by topoisomerase at 9:42 PM on September 9, 2013 [3 favorites]

Windows Defender Offline is not the same thing, and it can very well run on a Windows 8 machine. It runs off of a USB drive -- it doesn't need Microsoft Security Essentials or Windows Defender on the computer it's run on or the computer that makes the USB drive.
posted by JHarris at 10:09 PM on September 9, 2013

New computer? Sledgehammer: start reformatting.
posted by converge at 1:46 AM on September 10, 2013 [1 favorite]

Seconding Ninite for the reinstall.
posted by Hogshead at 3:18 AM on September 10, 2013 [1 favorite]

Don't bother trying to clean it if there's nothing on the computer that's worth saving. You will save yourself a lot of time and headache just doing the OS reinstall and starting over.
posted by Gev at 4:54 AM on September 10, 2013 [1 favorite]

Another vote for reinstalling. Use Double Driver to backup and quickly reinstall your drivers and Ninite to reinstall your favourite applications (including Firefox).

Turn off Windows Update until after everything is re-installed, then turn it on and get only the critical Updates. The others can download and install automatically when you aren't around.

Will take you about an hour to do and guarantees that you'll be virus free. Attempting to clean up the mess can't do that, ever.
posted by mr_silver at 5:38 AM on September 10, 2013

If this is a new computer and you didn't install the OS, I'd restart the machine and look for a System Restore Utility or something of that nature on the boot screen. You'll likely have to press a button to start it.

It's a utility you can run before Windows starts to reformat and wipe your machine to factory settings, and will be the easiest solution compared to installing the OS, making backups, saving drivers, etc. After doing so, you'll have the computer at its "out of the box" state, ready to be set up once more.
posted by brocrastinator at 6:45 AM on September 10, 2013

Most computers these days actually have a secret keypress you can press while booting, unmentioned onscreen, to boot from a recovery partition. Search the web for it -- but note, some manufacturers use more than one, so don't despair if the first one you find doesn't work.

It is possible for malware to interfere with that process though, if it changes the partition map or modifies that partition.
posted by JHarris at 8:35 PM on September 11, 2013