What are the steps to efficiently scan & remove viruses & spyware?

[frase]

This is my general run through

If I can target the process when system starts, I stop it from process manager then hunt the file down manually - they are generally only located in specific areas ie; TEMP, sys32 etc

msconfig - check for irregular entries and remove
Delete items from the C:\Documents and Settings\USER\Start Menu\ folder

regedit -Check in the registry 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and RunOnce entries - delete any irregular entries

Check the TEMP & Internet folders and clean all files out.

Check HOSTS file in regards to browser hijacks - and IE or FF settings and set to default.

After I do all this manually then I normally run a software application to make sure, such as SUPERAntiSpyware

 

[U.V.K]

This is my general run through

If I can target the process when system starts, I stop it from process manager then hunt the file down manually - they are generally only located in specific areas ie; TEMP, sys32 etc

msconfig - check for irregular entries and remove
Delete items from the C:\Documents and Settings\USER\Start Menu\ folder

regedit -Check in the registry 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Run and RunOnce entries - delete any irregular entries

Check the TEMP & Internet folders and clean all files out.

Check HOSTS file in regards to browser hijacks - and IE or FF settings and set to default.

After I do all this manually then I normally run a software application to make sure, such as SUPERAntiSpyware

Since you use that manual procedure, maybe you should check a tool that I created and am sharing with everyone on TN: UVK. It will allow you to do everything you said in a few seconds and lots of other fixes.

 

[frase]

Will check it out, thanks Eureka

Im still a stickler for rechecking entries manually though, damn OCD hehe

 

[FoolishTech]

I mostly do it manually

Well, to be correct I used to mostly do it manually, but now I use a program that I wrote which I call D7 to AID me in doing the bulk of the malware removal. All the program does (other than absolutely everything) is allow me to quickly and easily view all the appropriate registry locations "manually" with whitelisting/blacklisting functionality and a few automated tasks as well.

Depending on the severity of the infection (or of course whether I am working remotely or not,) sometimes I start the malware removal with D7 on the system live, sometimes use D7 in offline mode via a network bootable Windows PE 2 based environment, if the machine is modern enough to be capable of booting to our network, or if not I attach it to a "tech bench" machine designed for scanning/removal.

I planned to post about D7 sooner or later anyway. If anyone is interested I have posted a new thread here.

Aside from D7, for infected file detection on an offline hard drive, on my "tech bench" computer I have Microsoft Security Essentials with realtime protection enabled (though I never actually run a scan with it) but instead I run a command line scan with Kaspersky's SOS tool which they made available to partners at one time (and I scan %systemroot%\System32 directory only if I'm in a hurry) so that when Kaspersky SOS scans each file, both it and MSSE (in real time) get their chance to find the virus.

As side note for those interested, it's been like 6 months since I've seen Kaspersky detect one that MSSE didn't catch first. I only still run Kaspersky due to the ability to do command line scans so I can automate the scans the way I like.

I will say this about MSSE though, I'm not happy with it's disinfection, I've seen it fail or screw up the file a number of times, so if it detects a legitimate file as being infected with an actual virus, rather than relying on MSSE to "disinfect" it I'm a fan of just replacing the file with a known good copy. For this reason I keep a copy of the Windows directories of fresh installs (and fairly patched/updated installs, I should add) on my network and will replace a file on an infected machine from that stash in a flash.

When I'm done with the "offline" portion of my scans, then I prepare for any live scans/removal. First I almost always just go ahead and boot to a CD and do a bootrec /fixmbr (vista/7) or fixmbr (xp) before I boot the system live to fix any MBR infection.

Then usually I boot the system, run D7 again which in turn runs Kaspersky TDSS killer (because that's a popular infection for me these days,) and occasionally a few other tools maybe a quick scan with GMER (never a full), and maybe Combofix if it's an XP box.

Worthy of note and I haven't seen it mentioned elsewhere here, I almost always run the obscure and not really malware related Driverview from Nirsoft because even though it isn't intended as a malware detection tool, it _always_ finds KLMD.SYS and other such rootkit like junk - although removal of said junk usually means I need to go back to the offline method, but at least Driverview lets me know when it's present.

For cleaning up the leftovers on the live system, I might run Malwarebytes and an app called Hitman Pro, though sometimes I skip them if I'm pressed for time, and they mostly only find cookies after I'm done with D7 anyway.

Finally if time permits, I will follow up with the client's own installed anti-virus package, whatever it may be, to ensure it doesn't find anything leftover and that it works properly.

 

[layoric]

If you remove the drive and hook to another PC and scan ,you still have to hook back to original PC to remove remaining malware when booted into Windows. Some malware has to be running to remove.

The file is still there, never came across that problem.

This might have been inferred that I just slave, scan, call it a day. NO! That's the FIRST step, next after the MULTIPLE scans slaved, reconnect to host (system) and scan and observe. Several reboots, testing for suspicious behavior. THEN it's done.

Virus removals are my most time consuming service, as it sometimes involves system repairs (OS) as well.

 

[red12049]

Interesting Stuff

In our shop, we usually hit an infected machine with combofix as the first attack. Since combofix will no longer run with AVG installed, we've taken to running the AVG uninstaller, frequently in safe mode.

With a lot of the newer scareware, running the AVG tool also removes the start point for the malware, making clean up a walk in the park. Haven't analyzed why yet, but it works.

Rick

 

[dragon2011]

How do you do this and what are the steps?
I am trying to learn as much as I can.

Are there any common viruses/spyware, that most infected computers get?

What do you do when a infection disguised as a anti virus/anti spyware, keeps popping up and cannot be un-installed? Ive tried spy doctor, ccleaner, hijackthis, AVG,ad-aware but it just does not go away. Im ready to re-format.

you can try to do safe mode with networking, then you run kaspersky, malwarebytes, panda and G-data . hope it will help you out.

 

[colonydata]

Normally i will do a quick visual inspection, to get the lay of the land. then i shut it off and use a av live cd, in the past it has been avg, but ive been kicking the tires on a couple lately. that normally doesn't get everything, but it thins things out enough to make things easier to work on.

then i will normally run a mbam full scan and hijack this, combofix if its need

get the onboard AV back up and running, and run a scan with that. verify that it is running with the eicar test string.

then i go through and check things like the hosts file, proxy settings etc, and generally just look for things that do not look right.

then generally i will run a registry cleaner like ccleaner to make sure i didnt miss anything in the registry.

make sure windows and the onboard av are up to date and run one more scan just to verify.

 

[praondevou]

a good software is using CCcleaner and Microsoft Essentials.

I had Bitdefender too, but it takes a lot of CPU power.

 

[FoolishTech]

msconfig - check for irregular entries and remove

I had the argument with a coworker the other day about msconfig's usefulness. He says it's worthless, I say yes it is as a malware fighting tool, however...

My theory behind using MSCONFIG is solely for removing non-malicious startup applications that the customer may actually need - but I just *think* they don't need them.

That way if the customer calls back wanting to know why that (what I thought of as irritating and unnecessary) startup app isn't running, (e.g. some crappy photo uploader software that runs every time you plug in a flash drive...) I can simply have them fire up msconfig and place it back into Normal Startup, and not have to worry about going through the list with them to find that one item, or having them adding back malware related entries and having file not found errors on startup.

Just my 2c on msconfig.

 

[Xander]

My theory behind using MSCONFIG is solely for removing non-malicious startup applications that the customer may actually need - but I just *think* they don't need them.
I can simply have them fire up msconfig and place it back into Normal Startup, and not have to worry about going through the list with them to find that one item, or having them adding back malware related entries and having file not found errors on startup.

That's, actually, a pretty good way of handing those. Noted.