I have seen some sites offering 'Malware University', training classes on getting rid of malware. Do you think that updating your malware removal skills (or arsenal) is necessary from time to time? How do you become more effective at dealing with this growing, very complicated, threat?


You don't "clean malware". You level the machines and start over. Anything less is a disservice to your Customer and asking for trouble.

As far as dealing with the "threat", you don't allow users to run with Administrator-level accounts (on Windows), and you don't install untrusted software (inasmuch as is possible). It seems fairly simple to me. My Customers and I do not have a problem with malicious software.

  • 11
    Downvotes, eh? Go ahead-- downvote me. I'm still right. smile "Cleaning malware" is bush league. After a malicious third-party has attacked your computer, keeping an untrustable operating system and application software around is a bad idea. – Evan Anderson Jun 17 '09 at 23:57
  • 4
    +1 for telling it straight. I do think it's good to understand how malware works, though -- so some reliable training from the likes of Mark Russinovich or SANS might be worth doing. – Ben Dunlap Jun 18 '09 at 0:15
  • 1
    So how do you define malware? Are you really advocating reinstalling the OS because you got something as innocuous as this? viruslist.com/en/viruses/encyclopedia?virusid=18321 I can understand reinstalling if you contracted some of the more nefarious malware..... – Josh Brower Jun 18 '09 at 0:23
  • 2
    I'm advocating leveling the OS and restoring only data files from backup if you care about the confidentiality, integrity, and availability of the data handled by a computer that has run malicious third-party code. If a malware author needs only to make their software have the outward appearance of being simplistic to cause you to trust that the machine is "clean" after you've tinkered with it, that's what the malware authors will do. – Evan Anderson Jun 18 '09 at 0:28
  • 1
    +1 for learned the hard way. – cop1152 Jun 18 '09 at 1:08

Beyond the sysadmin practices of not letting users run administrator level accounts and such, a lot of the responsibility falls on you to remain up to date on threats in the wild. Read the warnings that popup when a new threat is found. Have an update policy for your software.

Nothing can destroy security faster than a determined user, so educate them about the dangers of clicking on random links in e-mail or installing applications unless they are sure of the source (etc), making sure to tell them that this is for the safety of the network and their home computers.

If you stay on top of news, and keep your users in the know, then you drastically reduce your exposure.


As far as "malware training" goes, the name alone is a bit too marketing-buzzword to inspire much faith. Perhaps I'm too much of a skeptic, but I feel that any specific "malware topics" are going to be obsolete before the class is in session.

Sure, some basic skills apply, but if an admin (or support tech) doesn't already know those things, I'd rather they format the machine (for the reasons Evan Anderson pointed out) instead of taking a chance on their cleaning skills.


Autoruns and Process Explorer from Sysinternals (now owned by MS) are your best friends. The 1-2 infections I see a week where a user has opened an attachment or visited a page a shouldn't have, and the (up-to-date!) AV hasn't complete blocked it, can generally be cleaned up in 30m-1h of effort with just these two utilities. The are pretty straightforward, and after your first few clean-ups you'll get a knack for knowing what needs to be killed/removed to get rid of the malware.

That said, every once in awhile you'll run across a peice of malware that isn't written by an idiot, so if you can't make any headway after 30 minutes, its time for a complete wipe/reload.

Keep in mind, this is more appropriate for SMB's where hardware isn't standardized. If you've got a system image and the user's files are backed up, it will be quicker to wipe/reload at the first sign of infection.

  • I consider myself fairly proficient with procexp and autoruns. Last time I used these tools to remove a virus everything looked squeaky clean, but it turned out that the computer was still transmitting spam messages - enough to get our IP put on several SMTP blacklists. The only way to be sure of a clean box is to rebuild. – Nic Mar 23 '10 at 5:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.