 |
|
| Enterprise Desktop Tips: |
|
|
|
Malware removal handbook
Kevin Beaver, Contributor
05.03.2006
Rating: -4.34- (out of 5)
|
It seems that one of the biggest problems plaguing Windows users -- both at work and at home -- is recovering from a malware infection. In fact, it's the most common problem posed to me in my SearchWindowsSecurity.com Ask the Expert forum. Whether or not they do any damage, certain adware, viruses, and (heaven-forbid) rootkits can really take considerable time to remove from a system.
I've come across various tricks over the years to remove virtually anything and at the same time keep your cleanup efforts -- and the ensuing stress -- to a minimum. Make sure you consider each of the following steps when the time comes to respond to an infection:
- Use several tools for cleaning up viruses, spyware, and rootkits. Many malware removal tools work in different ways and some are certainly better than others, so if you're having trouble getting your system cleaned up, make sure you try two, three, four or more. It's almost guaranteed that you'll find one that works. Some tried and true options I've used are:
- Try some of the free tools available for online scanning. A Google query of "free antivirus" should be able to point you in the right direction. Here are some that have worked well for me and others in the past:
- Check all the obvious places such as your Windows startup folder, the Startup tab in msconfig, and any registry keys referencing this program under HKEY_LOCAL_MACHINE/Software/Microsoft/Windows/Current Version/Run in regedit. Also, you cannot underestimate malware that's located in a seemingly benign directory such as the Windows temp directory. It's therefore important to run a full system scan.
- Dig in deeper. Try loading Sysinternals' Process Explorer to view loaded processes and applications and possibly track down the malware in action. You can also run Foundstone's
To continue reading for free, register below or login
To read more you must become a member of SearchEnterpriseDesktop.com
href="http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/proddesc/vision.htm">Vision to search for malware bound to a local TCP or UDP port. You can also use your personal firewall's application protection feature (if supported) or a network analyzer such as CommView or Ethereal to see what's taking place behind the scenes. This can help reveal suspect protocols and traffic entering and leaving your computer that you'd otherwise be unable to see.
- Unload any software you suspect to be infected and then re-run your scans. It could be that your software has files open blocking any cleaning or quarantine attempts by your malware removal software.
- Try disabling system restore and booting into safe mode (here's a good reference) and then running your virus/spyware testing tools. Also, some antivirus programs come with a bootable CD you can run as well.
- You may have software corruption or a hardware problem rather than a malware infection. Try reinstalling Windows or your affected application(s). If that doesn't work, try to recall any recent hardware changes you've made such as adding memory, a video card, etc. You could have some bad memory, a poorly-seated PCI card, or other issue that could take forever to figure out unless you get your hands dirty troubleshooting at that level or having it looked at by a qualified technician.
- Don't totally rely on Google or your favorite search engine to find specifics on how to clean up your system. Check vendor sites directly. I've had to browse antivirus and antispyware sites (Symantec, Trend Micro, Sophos, and others) to find the right answers many times over. Symantec's Security Response site and CA's Spyware Encyclopedia site both contain a lot of good information. Also, check Google Groups postings as well as they often contain a wealth of information from other users that you can't find anywhere else.
- Antivirus and antispyware vendors may have specific removal tools that you've likely never heard of but still need to help with your disinfection. Don't be afraid to use a tool from a vendor other than your current antivirus or antispyware vendor. Their tools should work even though you have a competing product installed and, sometimes, it's the only option.
- Hash suspect files using HashCalc or similar tool and compare your results to known good copies off of installation media or a known clean system.
- When in doubt, reload. If you cannot get Windows to load -- it is locking up or continuously rebooting at a certain point -- even in safe mode, then you may have to take more drastic steps to recover your system. But before you do that, you should try Winternal's ERD Commander to see if you can get back in at least long enough to copy data files you don't want to lose. Beyond that, you can restore from backup, or reformat and start all over. As drastic as this may sound, it'll likely take less time than trying to troubleshoot this further, and you'll have a clean system to boot.
- At the enterprise level, you really need a formal security incident response plan. It's one thing to clean malware off one or two systems but quite another to respond to a widespread outbreak across an entire network. The following sites are great starting points:
About the author: Kevin Beaver is an independent information security consultant, author, and speaker with Atlanta-based Principle Logic, LLC. He has more than 18 years of experience in IT and specializes in performing information security assessments. Kevin has written five books including Hacking For Dummies (Wiley), Hacking Wireless Networks For Dummies, and The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He can be reached at kbeaver @ principlelogic.com.
|
|
|
|
|
|
|
|
|
| TechTarget provides technology professionals with the information they need to perform their jobs - from developing strategy, to making cost-effective purchase decisions and managing their organizations' technology projects - with its network of . |
|
| |
All Rights Reserved, , TechTarget |
|
|
|
|
|
