How would you fix a badly infected PC?

[walterbyrd]

Please note: I am not asking about prevention.

Let's suppose somebody gives you a PC that is loaded with malware, and
it's your job to fix it.

What is the fastest, easiest, way to go about it?

Is there any way to clean the machine without loading any new software
on it?

Would it be best way to clean the machine without booting the machine
from the infected drive? For example should the hdd be removed, and
connected to another PC as a second drive? Or, should you boot from a
CD, then have a networked computer actually clean the drive? And what
software woud you use to clean the infected drive? Can the process be
automated?

Thanks, in advance.

[Crispy Critter]

On 26 Oct 2006 13:43:58 -0700, walterbyrd wrote:

> Please note: I am not asking about prevention.
>
> Let's suppose somebody gives you a PC that is loaded with malware, and
> it's your job to fix it.
>
> What is the fastest, easiest, way to go about it?
>
> Is there any way to clean the machine without loading any new software
> on it?
>
> Would it be best way to clean the machine without booting the machine
> from the infected drive? For example should the hdd be removed, and
> connected to another PC as a second drive? Or, should you boot from a
> CD, then have a networked computer actually clean the drive? And what
> software woud you use to clean the infected drive? Can the process be
> automated?
>
> Thanks, in advance.

It's quicker to wipe and reinstall than attempt to fix it. There are people
who claim they can fix it but IMO they can never be 100% cetrtain the PC is
completely clean. Wipe and reinstall does.

[David H. Lipman]

From: "Crispy Critter" <not@for.email>


|
| It's quicker to wipe and reinstall than attempt to fix it. There are people
| who claim they can fix it but IMO they can never be 100% cetrtain the PC is
| completely clean. Wipe and reinstall does.

If there is important data on that PC you just wiped, you might have a clean PC but data is
more valuable than time.

If you are going to make a blanket statement, add backing up the data such as creating a
Ghost image of the platform PRIOR to wiping the PC.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Crispy Critter]

On Thu, 26 Oct 2006 22:41:00 GMT, David H. Lipman wrote:


> If you are going to make a blanket statement, add backing up the data such as creating a
> Ghost image of the platform PRIOR to wiping the PC.

Um, I would have thought that is common knowledge, no?

[Lee]

Crispy Critter wrote:
> On Thu, 26 Oct 2006 22:41:00 GMT, David H. Lipman wrote:
>
>
>> If you are going to make a blanket statement, add backing up the data such as creating a
>> Ghost image of the platform PRIOR to wiping the PC.
>
> Um, I would have thought that is common knowledge, no?

You make the assumption that knowledge is common! It isn't!
Regards
Lee

[David H. Lipman]

From: "Lee" <glog@sympatico.ca>

| Crispy Critter wrote:
>> On Thu, 26 Oct 2006 22:41:00 GMT, David H. Lipman wrote:
>>
>>> If you are going to make a blanket statement, add backing up the data such as creating a
>>> Ghost image of the platform PRIOR to wiping the PC.
>>
>> Um, I would have thought that is common knowledge, no?
|
| You make the assumption that knowledge is common! It isn't!
| Regards
| Lee

Agreed. It needs to be stated.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm

[Gaz]

walterbyrd wrote:
> Please note: I am not asking about prevention.
>
> Let's suppose somebody gives you a PC that is loaded with malware, and
> it's your job to fix it.
>
> What is the fastest, easiest, way to go about it?
>

i) install a good virus checker (update it)
ii) install a good spyware checker, spybot, adaware, superantispyware and
hijackthis. (update them all)
iii) Go into safe mode, and run virus checker, run adaware, run spybot
reboot into normal windows
iv) Run hijackthis and thin out most of the **** on there....
v) Make sure that you have the windows firewall or a third party firewall
switched on, install firefox and you are probably safe.

Gaz

[walterbyrd]

Gaz wrote:
> i) install a good virus checker (update it)
> ii) install a good spyware checker, spybot, adaware, superantispyware and
> hijackthis. (update them all)
> iii) Go into safe mode, and run virus checker, run adaware, run spybot
> reboot into normal windows
> iv) Run hijackthis and thin out most of the **** on there....
> v) Make sure that you have the windows firewall or a third party firewall
> switched on, install firefox and you are probably safe.

Do you think it's a good idea to try to install AV and anti-spyware
software on a PC that is already badly infected? My understanding is
that the existing malware can afect such installations.


>
> Gaz

[Crispy Critter]

On 30 Oct 2006 19:07:45 -0800, walterbyrd wrote:


> Do you think it's a good idea to try to install AV and anti-spyware
> software on a PC that is already badly infected? My understanding is
> that the existing malware can afect such installations.
>

What would be ideal is anti spyware software that runs off a thumb drive or
boot cdrom and doesn't require any instalation into windows. I don't know
of any such software though except rootkit revealers and Clamwin
anti-virus. Once compromised I always format but the approach you take is
up to you. Actually, I've recently invested in some imaging software
(Acronis True Image) so if I am ever compromised restoring will be a minor
thing and won't require reactivation of XP. Haven't needed to use it yet
though.