What program do you use to remove rogueware?

[atlanticjim]

Here is a post from me about a year ago. I have had good commments on it so I am repeating.

Just a few comments.

You MUST get adept at manual virus removal as that is the way to speed up your work (read $$) and set you apart in the marketplace. Last week I got an unbootable machine that was quoted $300 from another shop to N/P without data backup. I was able to clean and restore to full function and already have two word-of-mouth referrals from it.

You will find many discussions about Nuke and Pave here in the forums and the consensus is that for home users it is a bad solution. It disappoints the customer in many ways, change to everything they got used to and leads to many call backs such as "where is that picture of the little man I used to click on to talk to my cousin in Minnesota?" "How come when I look at my pictures it looks different, I want it the same" (file extension linked to some default viewer instead of the proprietary one that installed when they installed their printer . . . yes . . I am talking about you HP). No MS Office installation disk 'cause it was a pirated copy from their old girlfriend's IT guy. It goes on and on and on.

The exception is the office machine with excellent backup and all necessary program install disks. There the N/P solution is expected.

Next point. MBAM is designed to work in a normally booted environment. Slave the drive and MBAM will only remove a portion of the offending rogue because it has not generated the random exe files that cause the rogue's behavior.

On my bench machine I have realtime scanning disabled. There is no good reason for it to be in place since I know what I am accessing, it slows everything down and when an infected drive is connected it does freak out.

If you are going to be learning manual virus removal, optimize your time by taking the virus jobs all together and only in the shop. Have three machines running your MBAM/Roguefix/UnHackme/DrWeb/SuperAntispyware/et. al. while you spend your time with one machine in "Manual Virus Removal University". (Multitasking = $$)

 

[AdamsAPlus]

Why is it every time on this forums someone asks a question about virus removal, it has to become a discussion on N&P vs Removal. Come on guys. Put this issue to rest. It's like the Christian arguing with the Atheist. There ends up being a lot of yelling and nothing changes. The Christian still believes he is right and so does the Atheist. So why bother trying to fight. It goes nowhere.

I believe in the removal. I would even go as far to say, that I enjoy the battle. Who is going to win, me or the virus. But then again I do offer N&P at a cheaper rate than a removal. (Only $10 cheaper) Then I do charge for back up so I could end up being more. If I loose the battle and have to N&P for a virus removal then the N&P + the back up will be charged at the Removal price. I do my best to explain all this to the customer and let them decide. 75% of the time they agree to the Removal.

Anyways to answer the OP. I use to many different methods to describe. But normally I start with Hirens. Boot to MiniXP. Look at the auto runs and run a quick scan of SAS. Then go from there.

 

[PC-MOT]

Atlanticjim,

you got any recommended reading / good links on the subject of manual removal tecniques??

 

[vdub12]

I have to agree with the comments that this subject has been beaten to death. However, I think many of the people that are defending N&P are not using relevant examples. Yes there are many situation where N&P is the way to go. A few would be bad hard drive, giving the system to charity, used system, nothings important and want it fresh, and maybe even badly corrupted system post virus. However, if you are N&Ping a system for run of the mill rogueware then all I have to say is does that come with pepperoni and pineapple.

My point is rogueware is just that. Its not hard. Even if a completely crippled machine takes me 2 hours to clean, which is very rare, its still worth cleaning it to give a system back to the customer the same as it was. If I do a N&P its because I don't trust that the system can be made right again not because I think it will be quicker. What this does for me is when a customer gets there system back they tell there friends "you would not believe it, I thought this system was a goner. When I got it back it was exactly the way it was and worked great" and not "You would not believe it I got my system back and all my files where gone and I had to buy another copy of office, I still can't find that recipe site I had bookmarked, and whats this fox fire here. I would have been better off buying a new computer" I don't know about you but I think this is why I get the referrals and i here the stories about the later. I here this story all the time. Customers don't understand they just want there computer fixed and they want it back the way they had it. A fresh OS to a customer is like a brand new thing that now they have to learn all over again and every time they can't find something "Its that dam techs fault"

 

[Don W.]

Just my 2 cents but I run everything ON the host machine. I'll pull the drive to do backups if necessary. Nuking the drive is a last resort, usually reserved for machines from certain teenagers I know... No I haven't done anywhere near the number of machines most of you have done but I've only absolutely had to nuke a couple of machines over the years.

 

[BryanVest]

I looked at Malwarebytes's website and they only update it every few months. Do they use a different detection method (not definition based) that makes this feasible?

Those are major program updates. They have definition updates just like anything else...

 

[coco3_man]

"I" remove the virus/spyware.

Software is used to assist removing stray entries in the registry and any left over program files.

Tom

 

[Vicenarian]

Ok, Chuck Norris joke.


How does Chuck Norris remove malware?














He doesn't have to. He looks at the machine, and the malware's gone. POOF!

 

[Cybjun]

safe-mode w/ networking > Autoruns > Combofix > SAS Portable > Malwarebytes > manual check > NPE. if that doesn't get the system clean, then I look at the windows load and see if its what would be better continue the malware/virus removal or suggest a reload. If its a simple install with nothing install is it really worth the time to me to keep going.

To refuse to reload windows is a dis-service to your clients as much as just doing a nuke & pave. there is a time and a place for every service.

 

[timmymacs]

ComboFix is the King! It fixes 90% of the virus problems i get called out to. Sometimes you have to play around with admin settings, and disable/uninstall Anti-virus, but Combofix wins!

 

[MobileTechie]

Why is it every time on this forums someone asks a question about virus removal?..

The real answer, I suspect is that N&Pers get the impression that the "manual" removal guys like to think they're going something elite and don't like the implied put down that they are not as good techs.

But let's face it, most manual removal revolves around checking a few reg keys and common directories for anomalous files. Not exactly breaking into the CIA's computer system. And even the most die-hard manual remover admits to doing a scan afterwards because it's a fact that nobody has the time to check all the possible reg keys and locations manually that a scanner can do. Afterall, it's a computer so it's DESIGNED to do things automated. So it kind of comes down to the timing of your scan which is pretty ludicrous thing to row about.

However the N&P guys probably ARE wimping out from digging just a bit deeper to find out about spotting rootkit hooks and unsigned drivers etc which might convince them that they are capable of declaring a system clean with some confidence afterall.

I of course, being perfect, trot along the pragmatic line between the two on my high-horse

 

[joydivision]

I am the same, I am not completly against N&P for virus removals but this year I don't think I have done a single N&P because of a virus

That said I am finding a lot of the time these days I can remove it within 5 minutes because a lot of systems are just the fake AV with Windows 7 64-bit, not come across a rootkit with these yet.

It seems to be XP which Vista 32-bit which suffer from all the major rootkit head aches.

 

[Cambridge PC Support]

this year I don't think I have done a single N&P because of a virus

same here, but I have done a few N&P's from the after effects of a virus, ie a trashed Vista network config

 

[Ccomp5950]

I use a server setup to PXE boot Plop Linux which automounts the hard drive and begins a scan using Avira's Antivir.

From there it pulls installers and other programs from the shared folder and places it on the hard drive C:\HC_Toolbox and adds a batch script the startup folder of all users to run TDSSKiller, Spybot and it starts Malware bytes.

This is my "If I need to just push a button and walk away" scenario.

For the ones where I don't have other computers to work on I do manual removal 90% of the time with a follow up of Malware bytes overnight. This is mainly so I keep up with what the common problems are and how to fix them should I not have my server available to me. I also have that same setup on a netbook that I can take on site and network boot computers with a cross over cable, customers like to watch and enjoy the custom boot art in the PXE menu.

 

[kagman]

We each have our own methods of getting rid of viruses. We can Nuke & Pave a system or try to remove the virus with various tools in our toolkits.

Home users do not want to lose anything they have on the hard drive because they don't have backups of that data. They don't have the software that is on the computer. Etc Etc.. Besides they usually think that MSoffice comes with the computer since its already on there lol... In cases like that a Nuke and Pave will not work for the client.

Before I start scanning and removing a virus I sit down with the customer and ask them simple questions. Do you have backups, cds/dvds that came with the computer, product keys, etc etc. I give them the worst case scenario to prepare them for the worst. Plus I take an added step of making an image of the computer first.

I'd rather not nuke and pave, but if thats my only option then I do it. Again this is just how I do things...

 

[Runscout]

Tools that I use are Rkill/SAS/Malwarebytes/Eset Online Scanner/MSE/Kaspersky Rescue disk/Avira Rescue Disk/ Autoruns and Process Monitor. Now I admit I'm sure as far as skills I have nothing on all of you. I'm still learning which is why I apologize for changing the topic but is there any resources you can all kindly direct me to in educating myself on manual removal. I have no idea what I'm looking for in registries or which folders I should be reviewing? I would genuinely appreciate it.

 

[Xander]

Runscout, one way is to look up every new malware you hear about, and recent ones, too. BleepingComputer is quick to put up removal tutorials. Start getting a feel for the patterns of where they try to hide things; in which folders. e.g. Using Autoruns, if I spot a program set to start from ProgramData or Application Data, that raises an immediate eyebrow. Same with Temp/Recycling.

Most malware do this. The exceptions are harder to spot and I'd bet most of us use scanners to find these. But by finding the common ones, you can usually get a system back to 'usable' so that you can get the slower work done.

 

[Runscout]

@eHousecalls.ca Thank you very much buddy. I appreciate your advice. I admit I've visited Bleepingcomputer a ton of times but it never occurred to me to look over the guides in finer detail. For instance I never actually even looked over the "Associated (malwarevirus name) files" section or "Associated (malwarevirus name) Windows registry information files" in those guides. I see your point now. As I review them I do notice some patterns. So far appdata, and temp like you mentioned yourself. I will be reviewing these from here on.

 

[uprighttech]

We normally start with a manual scan in Safe Mode or Linux/PE bootable environment. After that, we scan with ComboFix, TDSSKiller, Malwarebytes' and SuperAntiSpyware and antivirus at a minimum. Occasionally we will use additional tools such as Spybot, Kaspersky or AVG Rescue CD, RKill, etc.

We normally find that removal is the quickest, easiest and cheapest fix. However, we are definitely not opposed to a nuke and pave if it looks like it will be easier and the customer doesn't have a lot of data that will need to be backed up/restored or installed application that we will have to reloaded. If a customer has a very infected system, only a few documents that need to be backed up and there is a recovery partition, we are fairly likely to wipe and reload.

 

[uberjew]

There is some great info in this post.

I almost always remove spyware locally. First, I uninstall any junk software in normal mode(if possible). Then boot safe w/net, run ccleaner portable, MBAM, combofix (rebooting back into safe w/net), and then HJT. Then I boot normal mode, surf Google News a bit to help make sure it's fixed and then flush System Restore. Repeat if necessary. I've usually had good luck with it.

If I spend more than 2 hrs on removing spyware, I recommend a reformat on simple installations or keep going on more complicated ones. Sometimes the time required isn't worth it on complicated installs either, and reformatting is the better way to go financially. I haven't had to reformat a PC because of spyware for a long time, though.