# IT GUYs: Method of virus removal
**URL:** https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186
**Category:** Shift518 Off Topic
**Created:** [February 7, 2010, 8:06am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186 "2010-02-07T08:06:06Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@Shady](https://forums.speedlife.net/u/Shady)
#### Post date: [February 7, 2010, 8:06am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/1 "2010-02-07T08:06:06Z")
So i figured I’d ask what some of you IT Guys or computer literate people do for virus removal. What programs you use, how effective they are etc.
Myself:
I remove viruses manualy, I boot to a WinPE disc, remove the virus by hand no programs etc.
First I tool thru the various places in the system folders that they like to hide, viruses 99% of the time are extremely easy to spot if you know what to look for.
After I delete the infected files themselves, I go into a Registry program and delete any registry keys associated with them.
Doing this manualy takes me all of ~20 minutes to remove a virus completely by hand, and 99% of the time I can get rid of the infection without even touching another program.
As good measure thou after I reboot normaly, I will open Malwarebytes and do a full scan, generaly nothing more than a few Registry keys ive missed come up, but every now and then I will have missed a DLL or EXE file that I was unsure of and renamed to .old
I do virus removal quite often, and honestly you cant beat doing it manualy once you know whats good, whats bad and what to look for. 10x better and faster than any virus scanner, although they should still be run as things can get overlooked.
So any other of you guys do things manualy? if not what programs do you have the best luck with, best detection rates weather its paid or free.
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 7, 2010, 9:36am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/2 "2010-02-07T09:36:40Z")
I also do it semi-manually.
When I get a PC:
1. Check task manager for anything funky. Usually there will be something there.
2. Search for said something. Usually it’s in C:\Windows\System32
3. Delete said something manually. This sometimes requires end tasking that process and then immediately deleting the file before it can relaunch (I’m sure you’ve seen some of those)
4. Go through Program Files, Add/Remove Programs for files/folders that shouldn’t be there
5. Run MsConfig, SpyBot, CCleaner, and ComboFix for safety
6. Give back to user
Our websense proxy detects a lot of spyware (if it’s trying to communicate with the outside world), so that helps a lot in knowing if a PC is cleaned or not.
---
### Author:  [@AMD\_IS\_THE\_BEST](https://forums.speedlife.net/u/AMD_IS_THE_BEST)
#### Post date: [February 7, 2010, 9:51am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/3 "2010-02-07T09:51:48Z")
Backup files. Format.
---
### Author:  [@Shady](https://forums.speedlife.net/u/Shady)
#### Post date: [February 7, 2010, 9:52am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/4 "2010-02-07T09:52:35Z")
> [@My New Ride](https://forums.speedlife.net/t/my-new-ride/29105/35):
>
> I also do it semi-manually.
>
> When I get a PC:
>
> 1. Check task manager for anything funky. Usually there will be something there.
> 2. Search for said something. Usually it’s in C:\Windows\System32
> 3. Delete said something manually. This sometimes requires end tasking that process and then immediately deleting the file before it can relaunch (I’m sure you’ve seen some of those)
> 4. Go through Program Files, Add/Remove Programs for files/folders that shouldn’t be there
> 5. Run MsConfig, SpyBot, CCleaner, and ComboFix for safety
> 6. Give back to user
>
> Our websense proxy detects a lot of spyware (if it’s trying to communicate with the outside world), so that helps a lot in knowing if a PC is cleaned or not.
Start using a bootable WinPE disc or something of the sort, if you know what kind of files to look for or the signs, makes it 10x faster… not to mention you dont have to deal with ending a task or unlocking a file, and if your unsure of a file you can just rename it to .old
Windows
Windows/system32
windows/system32/Drivers
windows/system32/Drivers/ETC
Program Files
“username”/Local Settings (always delete the Temp and Temp internet Files folder)
“username”/Application Data
HAH yes i used forward slashes, im to lazy to change it
theres a few more i cant think of off the top of my head at the moment
Sort by date modified, usualy a virus will be extrememly recent, and generaly you can pick out very quickly whats not legit.
Then use a program liek Reg Editor PE to go thru the registry to delete any reg entries associated with them, along with making sure under Winlogon everythings legit…
My fav one so far is WinLogon32.exe being called to launch under the userinit registry key, when your emove the virus it goes into a log on/log off loop as its supposed to be pointing towards userinit.exe
As Far as combo fix goes, its helped me alot, bu doing massive ammounts of virus removals, ive realized its extremely ineffective against a lot of things, breaks a lot of files… and can cause some serious system file issues depending on the serverity of infection.
Anyways, learn to manualy remove shit, will make your job 10x easier and allow you to turn around a machine in less than an hour instead of waiting 1-2 for scans to complete and it possibly not fixing the problem or causing other issues.
I can reemove the viruses in a machine in 20 mins sometimes less depending on servierity, and 99% of the time I could just leave the machine after that and it would probably be 100% fine, but I do like to do a spybot or malware scan when im done to clean up any registry files or small files I may have missed, which sometimes happens haha
Very rarely do I come across a virus that completely does something so out of hand that I need a program to get rid of it, and those fucking suck, but you always learn something… its amazing how tricky these fuckers have gotten
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 7, 2010, 9:57am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/5 "2010-02-07T09:57:12Z")
Well I’m kind of handcuffed in a way. I need to provide logs to Security for every infected machines. That’s why I have to use programs for the most part.
I’m usually not pressed for time and people expect the worst. My usual build/rebuild/cleanup is about an hour or slightly less. People expect a couple hours. So it’s a win win in most cases.
Only thing I hate is working with machines from other geographical areas.
---
### Author:  [@99FRC](https://forums.speedlife.net/u/99FRC)
#### Post date: [February 8, 2010, 6:35am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/6 "2010-02-08T06:35:30Z")
First, it depends on the the type and severity of the virus. If it is something simple, I manually uninstall it. If it is complex but not going to destroy the system, I will back up the data and run ComboFix. ComboFix is perfectly safe if you know what you are doing.
If the system is gone beyond saving, (attached to system files that will be destroyed upon removal) I will salvage the users files, format, and reinstall the OS/Files.
---
### Author:  [@ninety1two40](https://forums.speedlife.net/u/ninety1two40)
#### Post date: [February 8, 2010, 6:40am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/7 "2010-02-08T06:40:28Z")
Any tips on spotting a virus by file name?
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 8, 2010, 7:21am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/8 "2010-02-08T07:21:16Z")
There are some that are a bunch of numbers like 234889342.exe. Thats the first one that comes to mind.
---
### Author:  [@KrazyKid](https://forums.speedlife.net/u/KrazyKid)
#### Post date: [February 8, 2010, 7:26am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/9 "2010-02-08T07:26:39Z")
> [@RS6 Crash](https://forums.speedlife.net/t/rs6-crash/29126/4):
>
> Backup files. Format.
+1 I dick with an infected machine for 40 minutes… after that I quite, backup and reinstall.
> [@noobie.....](https://forums.speedlife.net/t/noobie/29146/2):
>
> Any tips on spotting a virus by file name?
If the shit just started or you know when it first began running like crap or started having issues, I put the view on DETAILS and filter by date modified, anything that sticks out or looks out of place is prolly the virus.
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 8, 2010, 7:29am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/10 "2010-02-08T07:29:32Z")
I use msconfig a lot. Sometimes if you go to startup you’ll see an entry that has no description or name. That’s a dead give-a-way.
---
### Author:  [@99FRC](https://forums.speedlife.net/u/99FRC)
#### Post date: [February 8, 2010, 7:30am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/11 "2010-02-08T07:30:50Z")
> [@noobie.....](https://forums.speedlife.net/t/noobie/29146/2):
>
> Any tips on spotting a virus by file name?
I run a security suite prior to Virus removal call IO Bit Security. Installs very fast and deep scans your system. It will tell you the names and how many variations of the virus are on your system. Whether its a hijacker, vundo, etc.
---
### Author:  [@Shady](https://forums.speedlife.net/u/Shady)
#### Post date: [February 8, 2010, 8:19am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/12 "2010-02-08T08:19:11Z")
> [@Homosexual Undertones - NYSPEED Edition](https://forums.speedlife.net/t/homosexual-undertones-nyspeed-edition/15447/222):
>
> First, it depends on the the type and severity of the virus. If it is something simple, I manually uninstall it. If it is complex but not going to destroy the system, I will back up the data and run ComboFix. ComboFix is perfectly safe if you know what you are doing.
> If the system is gone beyond saving, (attached to system files that will be destroyed upon removal) I will salvage the users files, format, and reinstall the OS/Files.
I’ve found combofix misses a lot of shit, but as far as “system being beyond saving” even if they are attatched to system files, its easy enough to replace them, depending on what the file is. But yes there are times where you just need to backup and start fresh.
> [@noobie.....](https://forums.speedlife.net/t/noobie/29146/2):
>
> Any tips on spotting a virus by file name?
As ILYA said, some are a bunch of random number likes 1234454.exe , some are just odd looking names like wasd23.exe/.dll/.sys etc…
Basicly if you know around the time the machine was infected you can sort by date modified as krazykid said, look at the publisher as for the most part 90% of legit files will have the publisher name attatched. If you arte ever unsure just google it, or rename it to .old … restart the system and see if anythings broken
> [@Taffys Meet anyone???](https://forums.speedlife.net/t/taffys-meet-anyone/29147/2):
>
> +1 I dick with an infected machine for 40 minutes… after that I quite, backup and reinstall.
>
> All depends on the situation with me, if I can have the customers machine here in the shop for awhile, if they dont mind leaving it a bit longer I am one of those people that much rather figure out the quickest way to get rid of it so that if I come accross it I know exactly what to do.
>
> I keep a notebook of all the crazy shit I come accross and what I did to fix it.
>
> If the shit just started or you know when it first began running like crap or started having issues, I put the view on DETAILS and filter by date modified, anything that sticks out or looks out of place is prolly the virus.
This, but if your unsure just alway rename to .old and if it breaks the system or a program just go back and fix it.
> [@Just Got A Bike ... And I Already Need Your Help!](https://forums.speedlife.net/t/just-got-a-bike-and-i-already-need-your-help/29082/13):
>
> I run a security suite prior to Virus removal call IO Bit Security. Installs very fast and deep scans your system. It will tell you the names and how many variations of the virus are on your system. Whether its a hijacker, vundo, etc.
By the time youve installed that and ran a full scan, i bet you could have had the virus almost completely gone and the machine uninfected in a 1/4 of the time. The only thing you really tend to miss is a few registry keys, but for the most part as long as you deleted any files their trying to call to it wont matter, just run a scan using something small and fast to find them… I’ve found that CCLeaner will acctualy kill registry keys left by viruses
Im not saying I dont agree with you, but why run the scan prior and have it take more time as its finding things rather than just delete everything you can find and run a scan that will presumably be much faster
Unless you need log files in which case I guess thats a different story
---
### Author:  [@Oppie1](https://forums.speedlife.net/u/Oppie1)
#### Post date: [February 8, 2010, 3:54pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/13 "2010-02-08T15:54:47Z")
I haven’t had to do this in quite awhile, since I don’t do this stuff really anymore, but I usually used my hard drive to USB converter and scanned the drive with AVG, then used spybot or adaware to check the disk again.
I would then put drive back in, scan it with spybot, adaware, crap cleaner, run any windows security updates, check for antivirus, check disk, and then defrag.
---
### Author:  [@Murrdog9000](https://forums.speedlife.net/u/Murrdog9000)
#### Post date: [February 8, 2010, 4:03pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/14 "2010-02-08T16:03:59Z")
Apple… no problems with virus’s
---
### Author:  [@bennyfizzle](https://forums.speedlife.net/u/bennyfizzle)
#### Post date: [February 8, 2010, 4:06pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/15 "2010-02-08T16:06:56Z")
> [@WTB: 92 - 95 civic hatchback](https://forums.speedlife.net/t/wtb-92-95-civic-hatchback/29120/12):
>
> Apple… no problems with virus’s
a fire. die in it.
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 8, 2010, 4:07pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/16 "2010-02-08T16:07:45Z")
> [@WTB: 92 - 95 civic hatchback](https://forums.speedlife.net/t/wtb-92-95-civic-hatchback/29120/12):
>
> Apple… no problems with virus’s
Because apples are only used by 10% of the population. :lmao
---
### Author:  [@Murrdog9000](https://forums.speedlife.net/u/Murrdog9000)
#### Post date: [February 8, 2010, 4:09pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/17 "2010-02-08T16:09:53Z")
haha… i knew i would get people riled up
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 8, 2010, 5:03pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/18 "2010-02-08T17:03:30Z")
I’m not riled. Mac’s run great and look great, but their functionality is limited in the business world.
I win. End of story. lol.
---
### Author:  [@Murrdog9000](https://forums.speedlife.net/u/Murrdog9000)
#### Post date: [February 8, 2010, 5:17pm UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/19 "2010-02-08T17:17:55Z")
> [@few questions on selling a car](https://forums.speedlife.net/t/few-questions-on-selling-a-car/29161/12):
>
> I’m not riled. Mac’s run great and look great, but their functionality is limited in the business world.
>
> I win. End of story. lol.
I could care less about the business world. I agree that it doesn’t have as much potential as windows, but all I need it to do is work correctly, I’m not into video or picture editing or music producing or hacking or anything like that.
---
### Author:  [@Ilya](https://forums.speedlife.net/u/Ilya)
#### Post date: [February 9, 2010, 6:11am UTC](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186/20 "2010-02-09T06:11:14Z")
Too each his own. I can’t justify the price of those things though. That’s my personal - against it/them. I can build a machine (desktop or laptop) way more powerful for that price.
[Next page](https://forums.speedlife.net/t/it-guys-method-of-virus-removal/250186.md?page=2)