How do you deal with malware on Windows?

Question

Simple: what do you do when they ask you the common question: "Can you clean my pc? Its so slow."

Answer 1

The answer to this will vary from person to person, company to company. I work at a University and when a slow, "dirty" PC comes across, a rebuilt is norm. I follow the same standard, coming from *NIX system administration: a compromised system doesn't get "cleaned", it gets rebuild.

I am sure others will use a myriad of tools available to try to accomplish this task.

Answer 2

We run into this daily. Since we bill our clients based on time, there is a limit to how much time we put into removing malware and rebuilding. In the past we could have spent a long time on removal and the time it took ended up being more than the cost of a new PC! Since then, we have a 1 hour rule...if after 1 hour of effort (not elapsed time waiting for scanners to finish), if it isn't gone, the whole PC is reimaged. It takes a lot less time and you know for sure that whatever it was is gone.

In that one hour, we:

• Check add/remove programs to see if anything snuck in there and remove it.
• We generally run a malware scan with F-Secure first.
• In our experience, one anti-malware program never catches all of it...so...
  • MalwareBytes
  • Spybot S&D
  • AVG
  • Ad-Aware
  • Sometimes Windows Defender finds things
  • Sometimes Windows Malicious Software Removal Tool finds things as well

After that, if there is still a problem that is clearly malware related, we revert back to a rebuild using a standardized Ghost image we have for each client.

Prevention is of course the best approach. In some situations we have deployed Deep Freeze which holds an image of your PC (Frozen). No matter what you do to that PC, all changes get wiped out on the next reboot as the frozen image is automatically put back and booted. There is an enterprise version which lets you manage your network PC's centrally if you like.

In addition to technology mitigation, education is also a great preventer! If you spend 10-15 minutes explaining to a user what to do and not to do, it can go a long way. Most users don't know what to look for, especially in Phishing schemes. 15 minutes today could save you hours later on.

Hope this helps. Good luck!

Answer 3

I generally start with the Task Manager to see what's running in the background. If they have some misbehaving software or general garbage, I'll ask if it's really needed and disable or uninstall the offending program.

Then I will clear out the Recycle Bin, Temporary Internet Files, and any other temp files hanging out on the system. Occasionally they use enough space to cause problems on older systems.

I will also check to see if the disk needs to be defragmented once those extra files have been removed. If the disk is fragmented badly enough, it can cause performance issues.

If the task manager shows software I'm not expecting or familiar with, I run SpyBot Search & Destroy or AdAware and work from there. This is usually enough to clean up most run-of-the-mill malware, but sometimes you have to dig deeper and run a full virus scan as well, and research removal techniques for anything else that is identified.

Worst case, a rebuild might be needed if it would require less work to reinstall than it would to clean up any infestations that are identified.

Answer 4

Checkout Lifehacker (links not working on SF so here is url, http://lifehacker.com/) for their ever evolving list(s) of software for dealing with malware.

AddAware won the last poll.

Answer 5

Run:

• anti-rootkit
• anti-virus
• anti-spyware

And then clean up remaining stuff with c-cleaner.

Answer 6

Mostly I get them to download and install Avast. 's worked well so far.

Answer 7

I start with Symantec Endpoint, their corporate anti-virus product. Full scan going 10 levels deep. I follow-up with an Ad-Aware scan. If anything is cleaned, restart the computer to make sure it's completely flushed out. If the malware persists, I'll run Spybot S&D, Windows Defender, and Malicious Software Removal Tool.

If some malware is removed and keeps returning, it may be hiding in system restore. Disabling system restore usually fixes this, but then you lose the ability to restore back to before the machine was infected.

If I can't solve it in two hours, backup and reformat.

Answer 8

For family and friends, I only agree to help them out if they promise that the next computer they buy is a Mac. So far this has worked out quite well; once they get the Mac I am rarely asked to help with this sort of stuff again.

Answer 9

Rootkits modify your operating system to hide themselves which makes them hard to find from within the infected operating system. Its easier to start your removal process offline, i.e. by using a live CD with Antivirus software included,like Ultimate Boot CD, or taking the hard drive out and scanning it using another hopefully uninfected computer.

I also don't trust one Antivirus or AntiMalware program to catch everything. At the tech shop I work at, we take the hard drive out and do an offline scan with ESET NOD32, AVIRA AntiVir and AVG Free. Then we put the drive back into the computer, boot into safe mode and run Spybot Search and Destroy, SUPERAntiSpyware and ComboFix. The we finish with CCleaner to clean up the left over registry entries. Sometimes we will add an additional scan or two with other Antivirus (Norton) or AntiMalware (Malwarebytes' Anti-Malware, AdAware or HiJack This) software if we think it is necessary.

But as someone else posted, the best way to clean an infected system is to reinstall from scratch. Just make sure that you scan the data you keep before copying it back onto your freshly set up computer.