Beat back that Trojan horse

Like its mythical namesake (dramatized in Lego), whatever crawls out of a digital Trojan horse will be a nasty surprise. A Trojan horse usually takes the form of an innocuous software program that unleashes a flood of malware or viruses after it's installed and run. Since attacks and ease of removal vary--an ad generator is easier to remove than a stealth rootkit--there's no one-size-fits-all solution. However, there are some common techniques for picking your way through the wreckage.

Reboot Windows in Safe Mode


What is Safe Mode?

Safe Mode is a diet version of the Standard Mode of Windows that your computer ordinarily runs. Rebooting in Safe Mode loads minimal programs and disables most device drivers that manage hardware like CD drives and printers. The result is a more stable iteration of the Windows operating system that's better suited for disabling malware while you perform a system scan.

How do you use it?

If you can, follow the necessary steps for a safe shutdown process and then reboot. When you restart Windows, as the screen begins to load, press F8 repeatedly until the Windows booting options appear. Select "Boot in Safe Mode" from the menu of options. Once in Safe Mode, you should be able to run your installed antispyware software with less interference from the malicious software that the Trojan brought onto your system.

System Restore


What is System Restore?

System Restore strings out a safety net if everything goes kaput. Under default Window settings, System Restore saves a snapshot of your computer configuration once a day and on major upgrades that can be used to replace corrupted files. In the event of a Trojan attack, System Restore can revert Windows to a previous, uninfected state. It won't restore everything, like changes to your user profile, but it does reinstate biggies like your Registry and DLL cache.

When do you use it?

When purging your computer of spyware, System Restore has an optimal time and place. You wouldn't want your computer including corrupted files as the reference point of the day, so it's important to disable System Restore before you start cleaning. You can reactivate it once your system is spick-and-span.

How do you use it?

The paths for accessing System Restore differ by operating system. In Windows XP, disable System Restore by right-clicking My Computer and selecting Properties. Under the Performance tab, select File System, then the Troubleshooting tab, and finally check Disable System Restore. You'll be prompted to reboot. Follow these steps to uncheck the box before restoring your system.

To use System Restore after scrubbing your computer, choose Accessories from the program list in the Start menu. You'll find System Restore under System Tools.

This comprehensive article from TechRepublic demonstrates how to create and use System Restore in Windows Vista.

Scan with antivirus/antispyware apps


Downloading diagnostic and removal tools with an infected computer is a huge time sink--spyware can cripple your speed and Internet access. The Trojan's payload could prevent EXE files from downloading or launching. Also, malware can affect the performance of installed security software on your PC. If you store your antivirus/antispyware programs on a CD or flash drive, however, those malware-busting apps can commence their swashbuckling unhindered.

Advanced users can save some time by creating a bootable DOS virus scanner that runs off a flash drive (tutorial from Ask the Geek).

Which antivirus software should you get?

Some of our favorite intrusion-repellants include Kaspersky Anti-Virus 6, which is worth the price (full review); Webroot SpySweeper and Spyware Doctor (the free versions identify but don't remove malware); AdAware and SpyCatcher Express (free spyware removal); and HijackThis (aggressive diagnostic tool). While none of these are Vista-compatible yet, Kaspersky and Ad-Aware plan to release Vista-ready updates in 2007.

HijackThis is a powerful tool that monitors the critical areas of your computer for any significant changes. Many forums administrators will want to analyze your HijackThis log before recommending a removal plan. However, the program requires a bit of learning before you can use it effectively. You'll want to read our HijackThis tutorial before getting started.

Disk reformatting


What is it?

Unlike a system restore, which rolls your operating system back to a previous configuration, disk reformatting requires you to reinstall Windows, plus all your data and applications, from scratch. This method is used to disable malware by overwriting corrupted files, replacing them with the default operating system.

Disk reformatting is a time-consuming measure, and one we at CNET Download.com recommend you try after scanning and restoring your system.

How do you reformat your hard disk?

There are several ways to overwrite the operating system, some more complex than others. Start by backing up irreplaceable files; when they're gone, they're gone. The most traditional way to reformat the hard disk is by using a boot disk or boot CD to work around your troubled operating system and load into DOS. From there you can use a combination of command prompts (like C> format) and DOS formatting tools like Fdisk and DELpart to reinstate a clean operating system. Many of these tools will delete corrupted files from the hard disk, so they will no longer be recoverable. This useful thread on CNET's forums explores some step-by-step reformatting options.

BootDisk.com provides free disk information for the gamut of Windows operating systems ("W2K" denotes Windows 2000.) Click on "DOS — Windows 9X/NT4/2000/XP Excellent Bootdisks," and then download the "custom" version of your operating system where possible. Apps like Nero and Roxio (free trials) are convenient for quickly setting up the requisite boot CD from the EXE boot file. You'll want to make sure your BIOS is set to read off the CD drive before you begin reformatting. If you've never worked with BIOS and DOS before, we recommend that you get help from someone with advanced knowledge.

For a less thorough workaround, you can try reinstalling the operating system. It's a simpler approach than reformatting with DOS, but it may not be able to disable fierce malware, such as a well-developed rootkit. Begin by feeding the original installation disk for your operating system into the CD-ROM. Choose to overwrite if you're given the option, but don't choose to make repairs.