Cleanup - a professional's report

floppybootstomp

sugar 'n spikes
Moderator
Joined
Mar 5, 2002
Messages
20,281
Reaction score
1,794
The following is from a thread at my other forum, BBF, from a guy named Grogan. This guy is good, knows Linux well (understatement) and fixes computers for a living.

The thread originated on the inadequacies of IE7 but kinda mutated into a general spyware/virus conversation.

Note he has precious little time for Avast, McAffee & Nortons.

Anyhow, I thought you fellas here might find this interesting, cos I did (and forgive me if the odd cuss word or two slipped through, BBF is not a family forum ;) ) :

Well... I don't get malware on my own system either, and I don't even use antivirus software. (don't want the extra overhead while playing games). My family doesn't get any either. I do give them all antivirus software (nod32) but they never run into anything because they don't do silly things, and their mail is all filtered anyway.

I work on computers as a business, and I'm pretty good at cleaning malware. (It's more than just watching scanners go round and round). Except for a few times with some very insidious rootkit type infections where I just ran out of time, and the odd time that after the cleanup Windows is just too far broken, I'm always successful. Clean install is a last resort, because most of the time people don't have disks for their software.

Yes, often I have to do some detective and assassination work to get to the point where I can install and update software. I also have to get rid of stupid **** like McNortonVast! that will get in my way before I can start.

I get crapcleaner and hijackthis installed. I get superantispyware installed, Spybot SD installed, Antivir installed and then I plug in the network cable and get them to date. I then disconnect the network again. In expert configuration of Antivir, I enable all extended threat categories.

I run crapcleaner, and depending on the situation and how much of a pain in the ass it was to get resident malware processes killed, reboot (Windows rebuilds the index.dat files). I run superantispyware and reboot, which takes out the bulk of the crippling malware on the reboot. It's about the best one for being able to do that, though it doesn't catch everything.

Then I boot to Safe Mode with command prompt and launch programs from the command prompt. (No explorer shell running). I scan with Spybot SD and use the advanced tools to clean up everything I can. Then it's a full system scan with Antivir. (always... it's the one I trust the most. I don't care what else they have)

After that, it's manual hunting and poking with regedit again, and if necessary I'll boot with the Ultimate Boot CD for Windows and use the offline registry editor and manually delete stubborn files. Some of that **** hooked by the winlogon process can't be deleted by any means while windows is running... the registry entries just get put back by things working in tandem.

Then I reboot normally start testing the system out and taking inventory to see that nothing is broken, while periodically checking with Hijackthis to make sure entries aren't coming back. I'll reboot several times.

It was after this point that I decided to do the Kaspersky online scan last night, which found nothing. Not a crumb. I was pretty confident that the system was clean, but since I had it here there was time. Antivir is very good at mopping up. Internet Explorer was working properly, and security was at the default settings.

If I have the system at my place, I'll bring it back to the customer and typically charge them about $120 for all this even though I might have spent 5 hours on it (I'm watching TV and stuff at the same time while tedious scans are running though). It's a Hell of a deal, to avoid a clean install. Most of the time I work at their home or office, and I charge $40 an hour. Cheap for an on-site technician.
 
Grogan is a top bloke who knows his stuff - I would urge everyone here to have a good read and take note of his advice :nod:
 
"My family doesn't get any either. I do give them all antivirus software (nod32) but they never run into anything because they don't do silly things, and their mail is all filtered anyway"
Hmmm you don't have to do silly things to get infected, and sorry I don't care how filtered you are or how protected you are..If a virus want you it will get you, there is always a way in, and it will keep looking until it finds that way in..
 
Madxgraphics said:
"My family doesn't get any either. I do give them all antivirus software (nod32) but they never run into anything because they don't do silly things, and their mail is all filtered anyway"
Hmmm you don't have to do silly things to get infected, and sorry I don't care how filtered you are or how protected you are..If a virus want you it will get you, there is always a way in, and it will keep looking until it finds that way in..

Not true, I'm afraid.

Protection works.

Most crap comes in through frequenting porn, p2p or kiddie sites such as msn, facebook et al.
 
floppybootstomp said:
Not true, I'm afraid.

Protection works.

Most crap comes in through frequenting porn, p2p or kiddie sites such as msn, facebook et al.

Hmmm no protection is fail safe...As for something coming through Fartbook, yeah that would happen if you could get on it..Was use MSN at work as well as E-mail, and to date haven't had any problems..As for porn, I grew out of that years ago..But I have got viruses from just veiwing normal day to day sites...Although come to think of it, my computers have been pretty good since installing Kaspersky..
 
Our Grogan uses Linux for everything except Games that only work in Windows and for that he has a stripped down version of Vista - so, no wonder no nasties eh?

I have a facebook site, no probs. Have also used msn in the past but rarely now, I'd rather meet for a drink or talk on the phone.

As for the other category, the day I grow out of being interested in that or females in general is the day I'm ready for my bath chair ;) As yet it ain't happened, in fact, only a few weeks ago.... *cough*

If a virus was that determined to be able to infect any system then everybody connected to the internet would be infected, wouldn't they?

Which is why I say 'Not true'

Your risk of being infected is directly proportional to the web sites you frequent although sometimes the most innocent looking sites are packed with nasties and you'd never even know. Just click the wrong button and..... it's fresh install time folks :)
 
floppybootstomp said:
he has a stripped down version of Vista - so, no wonder no nasties eh?

I'd rather meet for a drink or talk on the phone.

As for the other category, the day I grow out of being interested in that or females in general is the day I'm ready for my bath chair ;) As yet it ain't happened, in fact, only a few weeks ago.... *cough*

:)

A stripped down version, I have seen plenty people doing this, and seen plenty of very unstable computers..
As for the other category, I think what I should have writen was, other half and kids put stop to it..Its something you never grow out of lol..Just taste varies as you get older...haha
 
Mr Madx, you have to understand Grogan - he is not as other mortals, lol ;)

My three daughters are now aged 21, 19 & 19. The 19 year olds are at Uni in Bristol & Cardiff, the 21 year old lives in London near me and is working.

The wife and I are no longer an item.

So - no probs ;)
 
floppybootstomp said:
Mr Madx, you have to understand Grogan - he is not as other mortals, lol ;)

My three daughters are now aged 21, 19 & 19. The 19 year olds are at Uni in Bristol & Cardiff, the 21 year old lives in London near me and is working.

The wife and I are no longer an item.

So - no probs ;)
Well I know not of this Grogan fella so can't comment..
As for the sprogs, the 5 year old has just started school, and have a 14 year old going on 35, wish she'd make like a 35 yearold and go home..As for the other half, if she keeps moaning about the dishes, her and I might not be an item much longer..They moan they need a dish washer, then maon that nobody does the dishes..lol
 
Yeah good post, i thought avast was one of the trusted freebies?

Personally i Use Kapersky as it only cost £17 for a 3 user DVD and Superantispyware, but on computers that i build if they don't wanna pay then i put avast on.

I ran avast on my own two PCs when my license for Kapersky ran out for about a month before i got another one but didn't have any problems with it.

I have facebook, don't use MSN and haven't had a virus or spy/malware ever.

Guess i will put Antivir on from now on then???
 
don't do as I do, do as I say

I've known Grogan for quite a long time, before BBF, never seen the man give bad advice, ever.

He don't leave "customers" PCs with no AV. ;)


:thumb:
 
Waynos_Face said:
i thought avast was one of the trusted freebies?
It is, but AntiVir is generally considered to be better. I find avast! is a resource hog.

What about the malware that HijackThis doesn't detect? It seems like he knows what he's doing so I assume that Grogan knows how to detect and remove that stuff based on the other tools and methods he uses ;) .

You may want to get him to give Malwarebytes' Anti-Malware a whirl ;) .


Good post :) .
 
Indeed it is a small world :) . Maybe that why his prices are almost identical to what I charge clients for the same sort of thing :nod: .
 
Back
Top