29. Removing Malware from Your System
Malware can affect your system in many different ways and SHIELD DELUXE 2013 approach depends on the type of malware attack. Because viruses change their behavior frequently, it is difficult to establish a pattern for their behavior and their actions.
There are situations when SHIELD DELUXE 2013 cannot automatically remove the malware infection from your system. In such cases, your intervention is required.
If you cannot find your problem here, or if the presented solutions do not solve it, you can contact the PCSecurityShield technical support representatives as presented in chapter “Support” (p. 137) .
29.1. What to Do When SHIELD DELUXE 2013 Finds
Viruses on Your Computer?
You may find out there is a virus on your computer in one of these ways:
■
You scanned your computer and SHIELD DELUXE 2013 found infected items on it.
■
A virus alert informs you that SHIELD DELUXE 2013 blocked one or multiple viruses on your computer.
In such situations, update SHIELD DELUXE 2013 to make sure you have the latest malware signatures and run a Deep System Scan to analyze the system.
As soon as the deep scan is over, select the desired action for the infected items
(Disinfect, Delete, Move to quarantine).
If the selected action could not be taken and the scan log reveals an infection which could not be deleted, you have to remove the file(s) manually:
The first method can be used in Normal mode:
1. Turn off SHIELD DELUXE 2013 real-time antivirus protection. To find out how to do this, please refer to “How Do I Enable / Disable the Real Time Protection?” (p.
141)
.
2. Display hidden objects in Windows. To find out how to do this, please refer to “How
Do I Display Hidden Objects in Windows?” (p. 142) .
3. Browse to the location of the infected file (check the scan log) and delete it.
Removing Malware from Your System
130
4. Turn on SHIELD DELUXE 2013 real-time antivirus protection.
In case the first method failed to remove the infection, follow these steps:
1. Reboot your system and enter in Safe Mode. To find out how to do this, please refer to “How Do I Restart in Safe Mode?” (p. 139) .
2. Display hidden objects in Windows.
3. Browse to the location of the infected file (check the scan log) and delete it.
4. Reboot your system and enter in normal mode.
If this information was not helpful, you can contact us for support as described in section “Support” (p. 137) .
29.2. How Do I Clean a Virus in an Archive?
An archive is a file or a collection of files compressed under a special format to reduce the space on disk necessary for storing the files.
Some of these formats are open formats, thus providing SHIELD DELUXE 2013 the option to scan inside them and then take appropriate actions to remove them.
Other archive formats are partially or fully closed, and SHIELD DELUXE 2013 can only detect the presence of viruses inside them, but is not able to take any other actions.
If SHIELD DELUXE 2013 notifies you that a virus has been detected inside an archive and no action is available, it means that removing the virus is not possible due to restrictions on the archive’s permission settings.
Here is how you can clean a virus stored in an archive:
1. Identify the archive that includes the virus by performing a Deep System Scan of the system.
2. Turn off SHIELD DELUXE 2013 real-time antivirus protection.
3. Go to the location of the archive and decompress it using an archiving application, like WinZip.
4. Identify the infected file and delete it.
5. Delete the original archive in order to make sure the infection is totally removed.
6. Recompress the files in a new archive using an archiving application, like WinZip.
Removing Malware from Your System
131
7. Turn on SHIELD DELUXE 2013 real-time antivirus protection and run a Deep system scan in order to make sure there is no other infection on the system.
Note
It’s important to note that a virus stored in an archive is not an immediate threat to your system, since the virus has to be decompressed and executed in order to infect your system.
If this information was not helpful, you can contact us for support as described in section “Support” (p. 137) .
29.3. How Do I Clean a Virus in an E-Mail Archive?
SHIELD DELUXE 2013 can also identify viruses in e-mail databases and e-mail archives stored on disk.
Sometimes it is necessary to identify the infected message using the information provided in the scan report, and delete it manually.
Here is how you can clean a virus stored in an e-mail archive:
1. Scan the e-mail database with SHIELD DELUXE 2013.
2. Turn off SHIELD DELUXE 2013 real-time antivirus protection.
3. Open the scan report and use the identification information (Subject, From, To) of the infected messages to locate them in the e-mail client.
4. Delete the infected messages. Most e-mail clients also move the deleted message to a recovery folder, from which it can be recovered. You should make sure the message is deleted also from this recovery folder.
5. Compact the folder storing the infected message.
■
In Outlook Express: On the File menu, click Folder, then Compact All Folders.
■
In Microsoft Outlook: On the File menu, click Data File Management. Select the personal folders (.pst) files you intend to compact, and click Settings. Click
Compact.
6. Turn on SHIELD DELUXE 2013 real-time antivirus protection.
If this information was not helpful, you can contact us for support as described in section “Support” (p. 137) .
Removing Malware from Your System
132
29.4. What to Do When SHIELD DELUXE 2013
Detected a Clean File as Infected?
There are cases when SHIELD DELUXE 2013 mistakenly flags a legitimate file as being a threat (a false positive). To correct this error, add the file to SHIELD
DELUXE 2013 Exclusions area:
1. Turn off SHIELD DELUXE 2013 real-time antivirus protection. To find out how to do this, please refer to “How Do I Enable / Disable the Real Time Protection?” (p.
141)
.
2. Display hidden objects in Windows. To find out how to do this, please refer to “How
Do I Display Hidden Objects in Windows?” (p. 142) .
3. Restore the file from the Quarantine area.
4. Insert the file in the Exclusions area.
5. Turn on SHIELD DELUXE 2013 real-time antivirus protection.
If this information was not helpful, you can contact us for support as described in section “Support” (p. 137) .
29.5. How to Clean the Infected Files from System
Volume Information
The System Volume Information folder is a zone on your hard drive created by the
Operating System and used by Windows for storing critical information related to the system configuration.
SHIELD DELUXE 2013 engines can detect any infected files stored by the System
Volume Information, but being a protected area it may not be able to remove them.
The infected files detected in the System Restore folders will appear in the scan log as follows:
?:\System Volume Information\_restore{B36120B2-BA0A-4E5D-…
To completely and immediately remove the infected file or files in the data store, disable and re-enable the System Restore feature.
When System Restore is turned off, all the restore points are removed.
Removing Malware from Your System
133
When System Restore is turned on again, new restore points are created as the schedule and events require.
In order to disable the System Restore follow these steps:
■
For Windows XP:
1. Follow this path: Start
→ All Programs → Accessories → System Tool →
System Restore
2. Click System Restore Settings located on the left hand side of the window.
3. Select the Turn off System Restore check box on all drives, and click Apply.
4. When you are warned that all existing Restore Points will be deleted, click Yes to continue.
5. To turn on the System Restore, clear the Turn off System Restore check box on all drives, and click Apply.
■
For Windows Vista:
1. Follow this path: Start
→ Control Panel → System and Maintenance → System
2. In the left pane, click System Protection.
If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
3. To turn off the System Restore clear the check boxes corresponding to each drive and click Ok.
4. To turn on the System Restore select the check boxes corresponding to each drive and click Ok.
■
For Windows 7:
1. Click Start, right-click Computer and click Properties.
2. Click System protection link in the left pane.
3. In the System protection options, select each drive letter and click Configure.
4. Select Turn off system protection and click Apply.
5. Click Delete, click Continue when prompted and then click Ok.
If this information was not helpful, you can contact us for support as described in section “Support” (p. 137) .
Removing Malware from Your System
134
29.6. What Are the Password-Protected Files in the
Scan Log?
This is only a notification which indicates that SHIELD DELUXE 2013 has detected these files are either protected with a password or by some form of encryption.
Most commonly, the password-protected items are:
■
Files that belong to another security solution.
■
Files that belong to the operating system.
In order to actually scan the contents, these files would need to either be extracted or otherwise decrypted.
Should those contents be extracted, SHIELD DELUXE 2013's real-time scanner would automatically scan them to keep your computer protected. If you want to scan those files with SHIELD DELUXE 2013, you have to contact the product manufacturer in order to provide you with more details on those files.
Our recommendation to you is to ignore those files because they are not a threat for your system.
29.7. What Are the Skipped Items in the Scan Log?
All files that appear as Skipped in the scan report are clean.
For increased performance, SHIELD DELUXE 2013 does not scan files that have not changed since the last scan.
29.8. What Are the Over-Compressed Files in the
Scan Log?
The over-compressed items are elements which could not be extracted by the scanning engine or elements for which the decryption time would have taken too long making the system unstable.
Overcompressed means that SHIELD DELUXE 2013 skipped scanning within that archive because unpacking it proved to take up too many system resources. The content will be scanned on real time access if needed.
Removing Malware from Your System
135
29.9. Why Did SHIELD DELUXE 2013 Automatically
Delete an Infected File?
If an infected file is detected, SHIELD DELUXE 2013 will automatically attempt to disinfect it. If disinfection fails, the file is moved to quarantine in order to contain the infection.
For particular types of malware, disinfection is not possible because the detected file is entirely malicious. In such cases, the infected file is deleted from the disk.
This is usually the case with installation files that are downloaded from untrustworthy websites. If you find yourself in such a situation, download the installation file from the manufacturer's website or other trusted website.
Removing Malware from Your System
136
