IT GUYs: Method of virus removal

[Shady]

@Ilya

I also do it semi-manually.

When I get a PC:

1. Check task manager for anything funky. Usually there will be something there.
2. Search for said something. Usually it’s in C:\Windows\System32
3. Delete said something manually. This sometimes requires end tasking that process and then immediately deleting the file before it can relaunch (I’m sure you’ve seen some of those)
4. Go through Program Files, Add/Remove Programs for files/folders that shouldn’t be there
5. Run MsConfig, SpyBot, CCleaner, and ComboFix for safety
6. Give back to user

Our websense proxy detects a lot of spyware (if it’s trying to communicate with the outside world), so that helps a lot in knowing if a PC is cleaned or not.

Start using a bootable WinPE disc or something of the sort, if you know what kind of files to look for or the signs, makes it 10x faster… not to mention you dont have to deal with ending a task or unlocking a file, and if your unsure of a file you can just rename it to .old

Windows
Windows/system32
windows/system32/Drivers
windows/system32/Drivers/ETC
Program Files
“username”/Local Settings (always delete the Temp and Temp internet Files folder)
“username”/Application Data

HAH yes i used forward slashes, im to lazy to change it

theres a few more i cant think of off the top of my head at the moment

Sort by date modified, usualy a virus will be extrememly recent, and generaly you can pick out very quickly whats not legit.

Then use a program liek Reg Editor PE to go thru the registry to delete any reg entries associated with them, along with making sure under Winlogon everythings legit…

My fav one so far is WinLogon32.exe being called to launch under the userinit registry key, when your emove the virus it goes into a log on/log off loop as its supposed to be pointing towards userinit.exe

As Far as combo fix goes, its helped me alot, bu doing massive ammounts of virus removals, ive realized its extremely ineffective against a lot of things, breaks a lot of files… and can cause some serious system file issues depending on the serverity of infection.

Anyways, learn to manualy remove shit, will make your job 10x easier and allow you to turn around a machine in less than an hour instead of waiting 1-2 for scans to complete and it possibly not fixing the problem or causing other issues.

I can reemove the viruses in a machine in 20 mins sometimes less depending on servierity, and 99% of the time I could just leave the machine after that and it would probably be 100% fine, but I do like to do a spybot or malware scan when im done to clean up any registry files or small files I may have missed, which sometimes happens haha

Very rarely do I come across a virus that completely does something so out of hand that I need a program to get rid of it, and those fucking suck, but you always learn something… its amazing how tricky these fuckers have gotten