Attack Plan Alex

Introduction This presents a step-by-step attack plan to clean up an infected computer This presents a step-by-step attack plan to clean up an infected computer For basic clean up run AV(anti-virus) software and anti-adware software For basic clean up run AV(anti-virus) software and anti-adware software For the harder to remove viruses use other more complex tools to remove them For the harder to remove viruses use other more complex tools to remove them

Run AV Software In order to run AV software you first need to purchase it In order to run AV software you first need to purchase it Disconnect from the Internet to save yourself from more mischief Disconnect from the Internet to save yourself from more mischief Boot into Safe Mode (press F8 when Windows begins to load) Boot into Safe Mode (press F8 when Windows begins to load) Insert the AV software CD. Then when the menu appears, install the software Insert the AV software CD. Then when the menu appears, install the software

AV (PART 2) Enter the information to register the Anti- virus software. You won’t be connected to the internet, but you will be set up to fully register when the connection works Enter the information to register the Anti- virus software. You won’t be connected to the internet, but you will be set up to fully register when the connection works During the installation, choose scan the system for viruses. Set the software to scan all type files and to look for all types of malware. During the installation, choose scan the system for viruses. Set the software to scan all type files and to look for all types of malware.

AV (PART 3) Sometimes the software detects a program you know you downloaded and want to keep. This is called grayware. Sometimes the software detects a program you know you downloaded and want to keep. This is called grayware. Reboot into Safe Mode with Networking, connect to the internet and allow you AV software to get any updates and if it requires you to reboot, then reboot into safe mode w/networking Reboot into Safe Mode with Networking, connect to the internet and allow you AV software to get any updates and if it requires you to reboot, then reboot into safe mode w/networking

AV (PART 4) After the updating is finished, scan your system again. Some malware will be discovered for you to delete. Keep repeating the process until all malware is deleted. After the updating is finished, scan your system again. Some malware will be discovered for you to delete. Keep repeating the process until all malware is deleted. Reboot your system and see if pop-ups still open up. If so you still have malware. Reboot your system and see if pop-ups still open up. If so you still have malware.

Clean-up (PART 1) Run Windows Defender and Ad-Adware to remove what is left. Run Windows Defender and Ad-Adware to remove what is left. However, you may need to go through and manually clean out your system. However, you may need to go through and manually clean out your system. After the first boot of AV software, you might find some start-up errors caused by incomplete removal of the malware. After the first boot of AV software, you might find some start-up errors caused by incomplete removal of the malware.

Clean-up (PART 2) For each program file the AV software said it couldn’t delete, try to delete it yourself using Windows Explorer. For each program file the AV software said it couldn’t delete, try to delete it yourself using Windows Explorer. Don’t forget to empty the recycle bin when finished. Don’t forget to empty the recycle bin when finished. To get rid of other malware files, you may need to delete temporry ie files. To do so use disk cleanup To get rid of other malware files, you may need to delete temporry ie files. To do so use disk cleanup

Clean-up (PART 3) Some malware hides itself in system restore. Some malware hides itself in system restore. To get rid of this malware, you must turn off system restore then reboot and turn system restore back on To get rid of this malware, you must turn off system restore then reboot and turn system restore back on Clean your registry. Clean your registry.

Clean-up (PART 4) Root out Rootkits: a rootkit is a program that uses unusually complex methods of hiding itself on a system Root out Rootkits: a rootkit is a program that uses unusually complex methods of hiding itself on a system Was originally used on Unix Was originally used on Unix Can prevent task manager from displaying the process or might cause it to rename the rootkit process Can prevent task manager from displaying the process or might cause it to rename the rootkit process Also might be hidden from registry editor Also might be hidden from registry editor

Clean-up (PART 5) Anti-rootkit software looks for running processes that don’t match up with the underlying program filename, and the software campares files, registry entries, and processes provided by the OS to the lists it generates from the raw data Anti-rootkit software looks for running processes that don’t match up with the underlying program filename, and the software campares files, registry entries, and processes provided by the OS to the lists it generates from the raw data

Finally, If you have done everything that is said here you will have to restore the entire system, or wipe your hard drive and re- install Windows and all of your applications and then restore your data. If you have done everything that is said here you will have to restore the entire system, or wipe your hard drive and re- install Windows and all of your applications and then restore your data.