How do I Ferret out a Trojan When Anti-Malware Doesn't Detect it?

ThatPlace928 said:
The only reason I thought it might be one now is because even the cloned drive produced the same results as her original drive and I wasn't sure enough about the cloning to know whether or not a virus would escape cloning or come over with it.
Click to expand...

Cloning does what it's name implies: Clones.

So if you have a hideously corrupted Windows instance on the source drive, you will have exactly the same hideously corrupted Windows instance on the destination drive. If you had an infection on the source drive, you will have exactly the same infection on the destination drive. Lather, rinse, repeat.

If, however, the problem was mainly with the source drive's own hardware, you can sometimes get a "miracle revival" with a clone, but it's quite rare, because a failing source drive generally means you're not going to get a good, complete, functioning result on the cloned drive.
 
britechguy said:
If, however, the problem was mainly with the source drive's own hardware, you can sometimes get a "miracle revival" with a clone.....
Click to expand...
That's exactly what I had hoped for..... a miracle. All is good now, though. Data files have been transferred, the laptop updated itself to Windows 11, and so far things are running well. I'm pleased and I believe the customer will be very happy that everything is functioning as it should. We went through what to keep and what to let go of earlier so her "new" system will be better than before. :)
 
Long ago I stopped trying to "repair" Windows, or any other OS for that matter, instances. Quickly learned I was putting in a lot of time that I wasn't getting paid for. Even in *nix's like Linux and macOS crap can happen that just can't be undone. So if a few things like , Disk Warrior, Tweaking AIO, antimalware scan, new profile, etc don't work it's nuke and pave time.
 
Markverhyden said:
Long ago I stopped trying to "repair" Windows, or any other OS for that matter, instances. Quickly learned I was putting in a lot of time that I wasn't getting paid for. Even in *nix's like Linux and macOS crap can happen that just can't be undone. So if a few things like , Disk Warrior, Tweaking AIO, antimalware scan, new profile, etc don't work it's nuke and pave time.
Click to expand...
I agree. For most customers, that's exactly what I do and everything goes back into balance so they can start with a clean machine. I've had a few ransomware cases lately and, as long as they don't have much on the laptop, it's easy peasy.

Customer just picked his Dell up yesterday, which fell victim to ransomware for the 2nd time in 2 years. The first time, he called the number and it cost him around $2,000. Then, they said he needed to pay $14,000 for a "very safe system [best in the market]" but he turned them down. They left time-delayed garbage on his system, though, and that's what recently came back. I did a fresh install of Windows 10, installed SuperAntiSpyware, MalwareBytes, and MB Browser Guard. He's got instructions on how and when to use everything to keep his laptop safe so, hopefully, he does.
 
With malware that can stay resident in the EFI and the SSD's firmware?

Format C: isn't good enough anymore, you have to flash all the ROMs too.
 
I've reached the point that I use nothing other than Windows Security. There was a time where Malwarebytes and similar were a very distinct "value added" but that time is long past.

I see lots of value in dumping what's no longer needed. Most of these utilities are dead weight. Pick a good all-purpose security product these days and you're done. And based on what those out there who analyze them say, Windows Security has been staying in the top ten for years now, literally:

AV Test (See Windows test section)

AV Comparatives (Reports Page – Look at Real-World Threat Protection and Advanced Threat Protection Test reports)

SE Labs (Reports Page – Look at Endpoint Security Reports)

MRG Effitas (360° Assessment & Certification Reports)
 
I just scanned the thread but didn't seen any mention of DISM?

DISM /Online /Cleanup-Image /RestoreHealth

I've complained in the past how DISM never fixes anything but this is one of the things it was built for.
 
Last edited:
Diggs said:
I just scanned the thread but didn't seen any mention of DISM?
Click to expand...

Nor did I. But I've posted the tutorial I hand out, Using DISM (Deployment Imaging Servicing and Management) and SFC (System File Checker) to Repair Windows 10 & 11, so many times now and I presume that DISM/SFC and, possibly, a full-repair install will be tried as a matter of course when Windows corruption is suspected.

My steps for what appears to be "Windows Wonkiness" are always:
1. DISM followed by SFC.
2. Windows Repair Install (or Feature Update if a newer ISO is available).
3. Completely clean reinstall of Windows.

You stop after whichever step indicates, "Problem Solved!"
 
ThatPlace928 said:
It's worked well for me for 14 years. I see no need to dump what works.
Click to expand...
IMO, SuperAntiSpyware is of the same ilk as Spybot S&D, Avast/AVG, Webroot, and many other "snakeoil" programs that cause more problems than they solve. They never were - nor ever will be - programs a professional Technician should or would install on a clients PC.
These are the kinds of programs unwitting (read cheap) end users install.

This has been recommended on Technibble. Its free and it works perfectly. Microsoft Defender

Rouge Security Products. to avoid.
 
Last edited:
Both Avast and AVG were, at one time perfectly legitimate antivirus/security tools, and both were ones I used. That being said, I stopped using them because they "went rogue."

Spybot S&D was once useful, too.

That wikipedia List of rogue security software does not list "legit" AVG, Avast, or Spybot S&D, but imposters for same. I still don't use any of them and don't recommend using them, but that list does not lump them in with the rogues.
 
Avast / AVG were quite good for a long while too. I stopped using them not so much because they were bad, but because their use injected additional risk that I didn't feel was worth the benefits when compared against Windows Defender.

Then there are the ads... oy the ads... just nope.
 
Sky-Knight said:
I stopped using them not so much because they were bad
Click to expand...

I guess that depends on our individual definitions of "bad." For me, AVG became so hypersensitive and so prone to constant false positives that I could no longer tolerate it, for myself, nor the endless client calls in a panic about nothing.

I have a fuzzier memory about Avast, but what I do recall is that after whatever it was that "turned" for me, I couldn't get away from it fast enough.
 
britechguy said:
I guess that depends on our individual definitions of "bad." For me, AVG became so hypersensitive and so prone to constant false positives that I could no longer tolerate it, for myself, nor the endless client calls in a panic about nothing.

I have a fuzzier memory about Avast, but what I do recall is that after whatever it was that "turned" for me, I couldn't get away from it fast enough.
Click to expand...
Yeah there was a window there right after Avast! bought AVG that both products started consuming systems during feature updates... that wasn't ideal. And yet, several AV vendors were suing Microsoft at the time because Microsoft wasn't releasing the data they needed to test things in advance, and in the process made their own security products look better. They won the suit... but we both know how that turned out. The monopoly carries on.
 
I find SuperAntiSpyware as usefull as a cup with a hole. It does next to nothing in my view just another snake oil product. MB is too annoyingly intrusive. Best practice is to nuke & pave if is a very intrusive trojan. It is up to the customer to have clean backups. Now I reckon you will get constant calls in regards to MB stating this or that.

I normally check drive for Issues if loading slowly or freezing etc
Run DISM
Run WRT.

The only tool I use is Windows Repair Tool, has everything one needs in one application and more can be added.
Created from a member here - @AlexCa

WRT
 
You must log in or register to reply here.

Similar threads

thecomputerguy
It's been a week.
Replies
11
Views
425
brandonkick
B
thecomputerguy
New clients MFA is all out of whack and not sure how to fix it.
2 3
Replies
50
Views
2K
HCHTech
HCHTech
Appletax
[SOLVED] Cannot Boot NTLite USB Flash Drive
Replies
2
Views
589
Appletax
Appletax
Big Jim
Stupid question, how do I reset a server ?
Replies
2
Views
518
Sky-Knight
Sky-Knight
U
How do I find out what model number a Lenovo laptop is?
Replies
9
Views
1K
NviGate Systems
NviGate Systems
Back
Top