- Joined
- Mar 5, 2002
- Messages
- 20,281
- Reaction score
- 1,794
The following is from a thread at my other forum, BBF, from a guy named Grogan. This guy is good, knows Linux well (understatement) and fixes computers for a living.
The thread originated on the inadequacies of IE7 but kinda mutated into a general spyware/virus conversation.
Note he has precious little time for Avast, McAffee & Nortons.
Anyhow, I thought you fellas here might find this interesting, cos I did (and forgive me if the odd cuss word or two slipped through, BBF is not a family forum ) :
The thread originated on the inadequacies of IE7 but kinda mutated into a general spyware/virus conversation.
Note he has precious little time for Avast, McAffee & Nortons.
Anyhow, I thought you fellas here might find this interesting, cos I did (and forgive me if the odd cuss word or two slipped through, BBF is not a family forum ) :
Well... I don't get malware on my own system either, and I don't even use antivirus software. (don't want the extra overhead while playing games). My family doesn't get any either. I do give them all antivirus software (nod32) but they never run into anything because they don't do silly things, and their mail is all filtered anyway.
I work on computers as a business, and I'm pretty good at cleaning malware. (It's more than just watching scanners go round and round). Except for a few times with some very insidious rootkit type infections where I just ran out of time, and the odd time that after the cleanup Windows is just too far broken, I'm always successful. Clean install is a last resort, because most of the time people don't have disks for their software.
Yes, often I have to do some detective and assassination work to get to the point where I can install and update software. I also have to get rid of stupid **** like McNortonVast! that will get in my way before I can start.
I get crapcleaner and hijackthis installed. I get superantispyware installed, Spybot SD installed, Antivir installed and then I plug in the network cable and get them to date. I then disconnect the network again. In expert configuration of Antivir, I enable all extended threat categories.
I run crapcleaner, and depending on the situation and how much of a pain in the ass it was to get resident malware processes killed, reboot (Windows rebuilds the index.dat files). I run superantispyware and reboot, which takes out the bulk of the crippling malware on the reboot. It's about the best one for being able to do that, though it doesn't catch everything.
Then I boot to Safe Mode with command prompt and launch programs from the command prompt. (No explorer shell running). I scan with Spybot SD and use the advanced tools to clean up everything I can. Then it's a full system scan with Antivir. (always... it's the one I trust the most. I don't care what else they have)
After that, it's manual hunting and poking with regedit again, and if necessary I'll boot with the Ultimate Boot CD for Windows and use the offline registry editor and manually delete stubborn files. Some of that **** hooked by the winlogon process can't be deleted by any means while windows is running... the registry entries just get put back by things working in tandem.
Then I reboot normally start testing the system out and taking inventory to see that nothing is broken, while periodically checking with Hijackthis to make sure entries aren't coming back. I'll reboot several times.
It was after this point that I decided to do the Kaspersky online scan last night, which found nothing. Not a crumb. I was pretty confident that the system was clean, but since I had it here there was time. Antivir is very good at mopping up. Internet Explorer was working properly, and security was at the default settings.
If I have the system at my place, I'll bring it back to the customer and typically charge them about $120 for all this even though I might have spent 5 hours on it (I'm watching TV and stuff at the same time while tedious scans are running though). It's a Hell of a deal, to avoid a clean install. Most of the time I work at their home or office, and I charge $40 an hour. Cheap for an on-site technician.