Manual Malware Removal Guide

[datadatau]

+1 on nice post.

Thanks, it is always good to take a fresh look at how others tackle a problem. I also like the manual approach.

 

[ZenMike]

Might as well not trust any system that's been on the internet in that case. Who's to say what system has been compromised or not? The worst infections are the one's that have no noticeable effect on your system, not the one's that pop up all over the place and try and scare your credit card # out of you.

This is a reasonable counter. So if it's more like the difference between a cold and cancer -- don't treat every sniffle like a critical disease -- , what are the warning signs that really set you off where you wouldn't attempt a repair.

Incidentally, I do manual cleaning most of the time. I'm just curious about the considerations others make in approaching the same problems.

 

[ComputerClinic]

Thanks for all the feedback. I updated my OP a little to include some of the suggestions given.

what are the warning signs that really set you off where you wouldn't attempt a repair.

There's never a time when I won't ATTEMPT a repair. I would at least get as far as ComboFix and if that won't work after a couple of scans then I would give up (although that hasn't happened since I started this method). Another scenario where I might do a fresh install would be if the machine had been infected for many months and the client continued to use the computer. In this case sorting by date doesn't help much and there are usually hundreds of malware files scattered throughout the HDD across multiple time periods. Even then, I would still do what I can manually and then run ComboFix and MBAM.

 

[BigFrog_Computing]

How about:

6b) Remove old Java and do Windows Updates.

Some compromised files might be overwritten with the newer versions by windows update. Plus known exploits are being patched making it harder for
the spyware to dig in. Then again, this can forever.....especially on old crappy P4s, netbooks, etc.

 

[All Systems Go]

Thanks for all the feedback. I updated my OP a little to include some of the suggestions given..

I do pretty much of the same approach, first disabling System Restore... but the ones that I have been coming across, basically disables all functionality of Malwarebytes, Task Manager, Regedit etc.

I've found that booting into save mode running Regedit and navigating to both
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
&
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
and search for a bogus file name (ie:nrsdofzfr.exe)

After verifying that it is in fact malware and deleting, you can reboot and run your favorite utilities (I usually use a few different ones, just to cover myself)

 

[seanh]

Wow, 1st post here and its on a rather heated topic

Ive just joined this site today, saw the guide section and was intrigued. I didnt expect this much of a debate over this topic. It seems this is a topic in which every tech has his own opinion on what works best.

Personally I love finding guides like this. It gives me a opportunity to see what works well for others and what others are doing to resolve this situation. I like the manual approach for a couple reasons. 1) I am a tech, I like fixing stuff. Its kinda why I got into this field. However from a efficiency standpoint if Im spending 5 hours fixing a infection when the box could have been reloaded in 2-3 hours its a poor use of my time. 2) I find occasions where I CANNOT dump and reload for whatever reason and HAVE to clean it. In those situations if the tech were solely reliant on tools and did not develop the skills to manually remove the infection he would be unable to resolve the issue. I feel that by manually removing infections it does build up that skill and it is necessary in some situations. Im not saying that scans are not useful. Just that they should be one of the many tools utilized. I must say to the OP that this guide is quite good. I image I will be spending a good portion of my next few days testing out some of the tools you have brought up.

However I must add one question. One of my preferred tools is Hijackthis. I have used it for quite a few years and am rather proficient in it. Does anyone still use it? Or has is there something else that you have found that is better?

 

[cvanhoof]

Great post! Thanks for sharing this

 

[Altster]

6) Reboot computer and see how things are.
-There should be no serious problems left.
-If there are, go back to step 2 and get some more practice.
-After some practice, you should be able to reach this point in 20 minutes or less.

I know this method isn't perfect. But I hope its helpful for those wanting to learn manual removal and increase malware removal speeds. I don't fully understand everything in EzPcFix and also don't know every location I should be checking for malware files, but I've had good luck with the above locations. I would appreciate any tips or improvements you could suggest and I'll update this post accordingly.

As a suggestion to all of this, any booting / re-booting that you do may I suggest you do it in safe mode w/networking? That way if need be, you can always update your tools without interference from memory-resident issues affecting the updates.

According to most other users here you should FIRSTLY make an image / clone of the drive before you attempt any repairs. If only to cover your @$$ in the event of major hardware / software failure(s) or other reasoning(s).

 

[ComputerRepairTech]

In my opinion the info in this post is out of date, out of order, highly inefficient and should not be used.

 

[MDD1963]

Step 9 (Combofix) would be somewhat 'problematic' for the 'handful' of Win8.1 and Win10 users.....

 

[amktechsolutions]

Very informative post, will definitely save this one for future reference