Detect and remove malware

Stay calm and avoid reacting too quickly.

• Use our guide to assess your situation and avoid unnecessary mistakes caused by rash or unconsidered actions.
• As long as you suspect that something is wrong, focus only on this issue. Until it is resolved, do not continue using your computer for work or leisure.
• Not every malfunction or unusual behavior is related to malware.
• If your PC is infected after all, different steps may be necessary depending on the malware. First, try to identify the type of malware precisely. 

Check for malware

Always consult the antivirus scanner installed on your own device. This helps you avoid falling for scareware. For example, it may report supposed virus detections in browser windows and urge you to download more software—for a fee. Another deceptive method involves simple extortion emails claiming that your computer is infected.

• Update the antivirus scanner installed on your computer, then run a complete scan of your system.
• If the antivirus scanner finds anything, it will list the programs it found and any cleanup it may have already performed. Write down the name of the malware found and the action taken by the antivirus scanner, or take a photo with your smartphone.
• If the antivirus scanner could not remove the malware completely, use another computer or your smartphone to search online for guidance on removing this malware.
• Even if the antivirus scanner was able to eliminate the immediate threat, we recommend backing up your important files afterward. Then reinstall your PC, as another undetected infection cannot be ruled out. 
• If the local antivirus scanner finds nothing, it may help to use a second scanner as well—for example, by booting from a rescue CD—and run another scan from there. (See the section "Das System mit einem Rettungs-Medium untersuchen")

Suspected ransomware

If you suspect that ransomware has infected your PC—for example, because Word documents can no longer be opened, the file extensions of familiar files are no longer correct, and/or a ransom note in the form of a text file is on your desktop—be sure to keep the following in mind:

• Immediately disconnect all connected external devices (for example, USB flash drives and external hard drives). There is a small chance that the data on these devices has not yet been encrypted.
• Do not connect any additional external devices (for example, USB flash drives) to your computer, as they could also be encrypted. Do not connect backup hard drives either.
• Disconnect the affected system from the network to prevent it from spreading further across your home network (unplug the network cable, disable WLAN).
• Keep the PC running and do not close any applications. Do not boot from a CD or USB drive either – restarting may trigger the „nächste Stufe der Erpressung,“ making it much more difficult to recover data.
• From this point onward, you need an expert's help.

Depending on the ransomware variant, your PC may have restarted automatically, and you may only see a text message about the extortion, with no operating system accessible. It is also possible that only certain file types (for example, Word or Excel documents) have been encrypted.

If only some file types have been encrypted, try saving any important documents that are still open locally with a different file extension (for example, as „DocumentXY.mine“) to avoid possible encryption. 

In any case, consult an expert to minimize the risk of further data loss. In some cases, digital forensics can still recover some data. For certain ransomware families, so-called decryptors are also available that can reverse the encryption.

In most cases, however, the data is permanently lost. That is why it is important to prepare for this possibility and back up important data daily to external storage devices.

Remove malware

How you remove a computer infection depends largely on the type of malware involved. The only way to make sure all traces of malware have been removed is to completely reinstall your system. With a good backup strategy, this is easier than it sounds.

Scan the system using rescue media

Many antivirus solution providers offer free rescue CDs to download. These usually include a separate operating system and tools for scanning the computer:

• Download the rescue CD files to another computer that is not infected.
• Follow the manufacturer's instructions to use them to create a recovery CD or a bootable USB drive.
• Shut down the infected computer, then restart it with the rescue CD or USB drive inserted.
• Follow the instructions displayed on the computer screen. The recovery software scans your PC and removes any malware it finds. To do this, you may need to temporarily reconnect your PC to the internet.

Once the malware has been removed from your computer, remove the recovery CD or USB drive and restart your PC. To be safe, run a full virus scan one more time to look for any additional malware. 

Remove spyware or Trojans

Malwarebytes Anti-Malware, for example, specializes in detecting Trojans and spyware. It is often recommended and available in a free version. If you suspect that your PC has been infected with a Trojan, Malwarebytes Anti-Malware may be able to identify and remove the malware.

• Download the free version from the manufacturer's website to your computer and install the program. After you start it, Malwarebytes Anti-Malware first updates its own signatures.
• After the update, Malwarebytes Anti-Malware starts. Click “Search Now.”
• This starts Malwarebytes Anti-Malware scanning your computer. This process can take a few minutes. 
• If the software finds infected items, it groups them in a list. Select these items in the list.
• Choose the command “Remove Selected” to remove the malware. 

For truly critical malware variants that spy on data and/or give an attacker access to your PC, you should play it safe and reinstall the operating system. During reinstallation, all data stored on the system is deleted. That is why it is important to back up your data regularly. A current backup minimizes data loss if you need to reinstall the operating system. 

Keep in mind that malware that had access to your system may also have collected personal information such as passwords, banking details, and contacts. Be sure to change the login credentials (passwords) for all accounts saved on the affected PC or entered during the infection. You should also keep an eye on your account transactions so you can respond in time.

Inform friends and acquaintancesOnce you have successfully removed the infection from your system, inform everyone you have exchanged data with in recent days. Your computer may have helped spread the virus.