How To Remove Possible Virus Files

Question

See the original question.

Using both AutoRun, where I disabled anything that wasn't verified or highlighted (that seemed suspicious), I looked at Process Explorer and found the above unverified. In the case of S Agent, I can't suspend it. However, these look like they were installed by Samsung but are no longer supported (according to web searches).

When I try to uninstall these applications, they refuse to uninstall. I did do the manual trick where I removed the files (they are no longer supported by Samsung, I find it odd that Samsung didn't do this themselves) - the one file that cannot be removed is an application called GuaranaAgent (under the Samsung folder). Unfortunately, wiping everything and starting over wouldn't work in this case because these retarded applications came with this computer - and this is kind of what I mean when I write that some of these viruses/malware are installed from the very beginning!

1. How do I get rid of these once and for all.
2. Adobe Reader and Acrobat Manager shows up as suspicious with a Total Virus score. I cannot suspend this process, as it just restarts if I do. How do I eliminate this once and for all - I don't need Adobe on this other computer. SOLVED: kill the process, delete the application. Done

UPDATE

I can't go to the store and say, "I want a computer with two browers on it: IE and Chrome and nothing else, outside of my anti virus Webroot." I don't want Adobe, I don't want Shockwave, I don't want anything else on this machine. I have a purpose for this machine (I have others) that Chrome and IE suffice for. That's it. How hard is it to just have a machine for this purpose? The applications that are suspicious were installed on my machine before I got it! That's what I mean how absurd everything is - what kind of company thinks that consumers are this stupid? "We're going to sell you a computer with malware on it." It's embarrassing.

Answer 1

In such cases I prefer to remove viruses by using a live system like ubuntu for example. This has the upside that the virus isn't curently executed and can't block your effort to remove it.

The process I usually follow is this:

• Reboot Host with Linux Live CD
• Mount Harddrive
• Delete Files manually (if location is known)
• Install a Antiv Virus software that runs under linux like clamav for example
• Download current anti virus signatures
• Scan the whole disk for viruses

Then reboot...

// This is not about trying another anti virus programm it's about running a anti virus application without running the compromised system. This is done because many viruses come with a rootkit or other mechanisms to protect themself from being removed but these mechanisms don't work outside the infected system. This is why I suggest to perform a anti virus scan outside of the system not because of the anti virus scanner itself.

Answer 2

This is a fairly simple process. Open up the good old cmd.exe and navigate to the location of this "virus" using CD C:\

Then type this:

attrib -h -r -s *.* 
dir /a /o:d | outfile text.txt
move [files that are not to be deleted] [safe location]
del *.*