Deep-Scanning Protocols for Stubborn Malware Infection

Modern malware doesn’t just copy files to your computer; it active-injects itself into legitimate system processes (like svchost.exe or explorer.exe) and hooks kernel functions to hide its folders. Once active in memory, malware can bypass standard user-mode antivirus scans by returning false integrity signatures.

To clean a deeply compromised system, we must disable the malware’s active processes. This protocol explains how to execute offline scanner loops, audit system persistence channels, and check for rootkits.

---

1. Deploying Microsoft Defender Offline Scan

An offline scan runs in a secure, isolated Windows Preinstallation Environment (WinPE) before the main Windows kernel and third-party drivers boot up. Because the malware is never loaded into memory, it cannot defend itself or block the scanner.

To launch Microsoft Defender Offline:

1. Save any open files.
2. Go to Settings > Update & Security (or Privacy & Security) > Windows Security.
3. Click Virus & threat protection > Scan options.
4. Select Microsoft Defender Offline scan, then click Scan now.

The system will restart into a basic console UI and execute a full scan of your boot sector and core directories. Any detected threats will be isolated or deleted before the main OS initiates.

---

2. Scanning with Specialized Remediation Tools

If adware, ransomware, or trojans survive the initial boot check, execute secondary runs using standalone, signature-heavy utilities that do not require full installations:

1. Malwarebytes AdwCleaner: Specifically targets browser hijackers, bundled PUPs (Potentially Unwanted Programs), and adware.
2. Kaspersky Virus Removal Tool (KVRT): A portable, signature-heavy engine that performs heuristic and deep disk scans.
3. HitmanPro: Uses a multi-engine cloud query system (comparing hashes against Sophos and Bitdefender databases) to find zero-day malware.

[!TIP] Download these tools on a separate, uninfected computer and copy them to a read-only USB flash drive. Boot the target PC into Safe Mode with Networking before executing the scans.

---

3. Auditing Malware Persistence

Once the scanner deletes the main payload files, the malware’s registry entries might try to re-download the virus upon the next reboot. To stop this, audit the three main persistence categories:

A. Registry Startup Run Keys

Malware frequently adds registry keys directing the shell to launch its files. Open regedit and audit these specific paths:

# User Specific Run Keys
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

# Machine Specific Run Keys
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

• Action: Look for arbitrary paths pointing to AppData\Local\ or Temp\ with suspicious .exe, .dll, or .vbs names. Right-click and delete suspicious values.

B. Task Scheduler Overrides

Open Task Scheduler (taskschd.msc) and click Task Scheduler Library:

• Look for tasks with random strings of letters or those executing PowerShell commands with -WindowStyle Hidden or -EncodedCommand flags.
• Select the task, go to the Actions tab, verify the target file, and disable/delete the task if it points to non-system directories.

C. The WMI Repository (Advanced)

Some sophisticated malware uses Windows Management Instrumentation (WMI) event subscribers to trigger payloads when the system is idle or at specific times. Run this PowerShell command to search for active WMI consumers:

Get-CimInstance -Namespace root\subscription -ClassName __EventConsumer

Look for command line consumers that invoke suspicious script shells and delete them.

---

4. Booting a Dedicated Rescue Disk

If the malware blocks Windows Security entirely, you must bypass the OS filesystem. Create a bootable Kaspersky Rescue Disk or ESET SysRescue Live USB drive:

1. Download the Rescue Disk ISO image.
2. Burn the ISO to a USB drive using Rufus.
3. Plug the USB into the infected computer, boot into your BIOS/UEFI, and change the boot order to launch the USB drive first.
4. The system will load a secure Linux-based desktop environment. Run the integrated scanners to disinfect the NTFS partitions without mounting them inside Windows.