This FAQ assumes that you are using a computer running Windows.

    Saint Mary's College recommends using Malwarebytes' Anti-Malware, a free malware removal program for Windows, for removing a majority of infections seen on personally-owned computers at Saint Mary's College.

    Individuals are encouraged to try the instructions below to remove malware on their own.

    Some malware cannot be removed easily. Computers that are infected and cannot access the Internet, cannot launch programs (especially malware removal programs such as Malwarebytes' Anti-Malware and McAfee VirusScan), or will not allow you to delete infected files may require professional assistance. The ResNet Office is available to assist students with personally-owned computers infected with such malware.

    Students are welcome to bring their computers to the ResNet Office. The ResNet Office provides technical support, including malware removal, free of charge to all Saint Mary's students. Students must be present in the ResNet Office while the staff works on their computers. The hours for the ResNet Office are available on the ResNet website (http://www.saintmarys.edu/resnet).

    Faculty and staff may contact the Helpdesk for assistance with their College-owned computers. The Helpdesk and ResNet Office are unable to provide assistance for faculty and staff personally-owned computers.

    Please note that you are welcome to follow these steps to clean your infected computer while you are connected to the network. However, if your computer's network access has been blocked because the infection was attempting to spread via the campus network, your computer will not be re-enabled until an RCC verifies that it is clean.


    Step 1. Malwarebytes' Anti-Malware

    • Follow the ResNet FAQ instructions for Malwarebytes' Anti-Malware (http://www.saintmarys.edu/resnet/resnetfaq/antimalware.html). Make sure to complete every section.

      • If you are unable to access the Internet from your computer, you can use another computer to obtain the Malwarebytes' Anti-Malware installer, place the file on a flash drive, and transfer it to the infected computer.


    Step 2. Install McAfee VirusScan

    • Install the latest version on McAfee VirusScan on your computer. Instructions are available at http://www.saintmarys.edu/virus.

      • Make sure you install the latest available version of McAfee VirusScan that your computer can support.

      • If you already have McAfee VirusScan installed on your computer, you should uninstall the software, reboot your computer, and then begin the installation process.


    Step 3. Internet and web browser settings

    • Some malware will change your Internet settings. To access the Internet, you will need to change them back.

      1. Open Internet Explorer.*
      2. Go to Tools => Internet Options => Connections Tab => LAN Settings.
      3. Uncheck "Use a proxy server."
      4. Recheck "Automatically detect settings."

    • Uninstall unwanted toolbars using the Programs and Features control panel.

      • From the Control Panel, open Programs and Features.
      • Scroll through the list of programs and uninstall any unwanted toolbars or other programs on your computer.
      • Restart your computer to complete the removal of the software.

    • Your web browser (Chrome, Firefox, Internet Explorer) may have extensions installed by the malware. You will need to remove these unwanted extensions. (Some extensions may be legitimate - use your judgement to delete the unwanted ones, or delete all of them to be safe. Legitimate extensions can always be reinstalled.)

      • Google Chrome:
        1. Click the Chrome menu (three short vertical lines) on the browser toolbar.
        2. Click Tools.
        3. Select Extensions.
        4. Click the trash can icon by the extension you want to remove.
        5. When the confirmation window appears, click Remove.

      • Microsoft Internet Explorer:
        1. Click the Tools button.
        2. Select Manage Add-ons.
        3. In the left column, select Toolbars and Extensions.
        4. In the right colum, select any extension you want to remove and click the Disable button.
        5. When the confirmation window appears, click Disable.
        6. After you have completed disabling unwanted Toolbars and Extensions, click on Search Providers in the left column.
        7. In the right column, select any Search Provider you want to remove and click the Remove button.
        8. If you wish, you can select a Search Provider you want to set as the default search option, then click the Set as default button.
        9. Click the Close button when finished.

      • Mozilla Firefox:

        1. Click the menu button (three short vertical lines) and choose Add-ons.
        2. In the Add-ons Manager tab, select the Extensions or Appearance panel.
        3. Select the add-on you wish to disable.
        4. Click its Disable button.
        5. If prompted, click to Restart Now.

    • If necessary, change your web browser home page back to a desired page, such as www.google.com. Detailed instructions for making Google (or any other website) your home page can be found at http://www.google.com/homepage/.


    Step 4: Scan with McAfee VirusScan
    Step 5: Quick Scan with Malwarebytes' Anti-Malware

    • Using the Malwarebytes' Anti-Malware software from Step 1, rescan your computer with a Quick Scan. If malware is detected after the quick scan, it is recommend that you obtain professional assistance with the malware removal.
    • If this step is taken on a different day from Step 1, please remember to update the database (Check for Updates) before running the scan.

    Step 6. Prevention

    • This is a list of all settings that you should check to prevent future infections. These are general directions - if students need assistance with these items, please contact the ResNet Office.

      • Make sure you have a password set for all accounts on your computer. The Guest account should be disabled if you are not using it. (Start -> Control Panel -> User Accounts. All active accounts should be noted as password protected.)
      • Make sure all critical and important Windows Updates have been installed. (Start -> Control Panel -> Windows Update.)
      • Make sure the Windows Firewall is enabled for all connections - wired and wireless. If the firewall cannot be enabled, there is likely residual malware on the computer.
      • Make sure that any peer-to-peer (P2P) file sharing software that may have been on the computer is uninstalled.
      • Confirm that the computer has been connected to the network following all of the instructions in ResNet's Purple Packet. To obtain a copy of the current Purple Packet, please visit the ResNet website at http://www.saintmarys.edu/resnet or visit the ResNet Office.

    Step 7: If problems continue . . .

    • Students are welcome to bring their computers to the ResNet Office. The ResNet Office provides technical support, including malware removal, free of charge to all Saint Mary's students. Students must be present in the ResNet Office while the staff works on their computers. The hours for the ResNet Office are available on the ResNet website (http://www.saintmarys.edu/resnet).

    • Faculty and staff may contact the Helpdesk for assistance with their College-owned computers. The Helpdesk and ResNet Office are unable to provide assistance for faculty and staff personally-owned computers.


Last Modified July 23, 2014