My New Spyware/Virus Removal Procedure

[D@annyBoy]

after approaching senior status, they will retire
and the young generation will start taking over
;-)

--

D@nnyBoy
Post your False Positives to
http://www.spynet.com/falsepositive.aspx

Have you tried posting your problems
not related to MS AntiSpyware to
news://msnews.microsoft.com

and please don't bother to send me private mail
because I don't check my mailbox regularly

Some malware seems to have multiple processes that look out for each
other. If you kill one, the others bring it back. How do you deal
with that using Task Manager? I use WinPatrol, which can kill
multiple processes simultaneously.

Kill the right one . Easier said than done. I just rely on instinct to
finger the culprit. Will check out WinPatrol as those instincts are
approaching senior status

Steve Wechsler (akaMowGreen)
MS-MVP 2004-2005

===============
*-343-* FDNY
Never Forgotten
===============

[snip]

It does save time. BTW, I like to use Task Manager to kill the malware
Processes right after indentifying them via Hijack This. Then use
MSConfig to prevent them from reloading on startup right after doing so.

Some malware seems to have multiple processes that look out for each
other. If you kill one, the others bring it back. How do you deal
with that using Task Manager? I use WinPatrol, which can kill
multiple processes simultaneously.

I'm down on Sysclean right now, since it runs slowly and it missed so
many infections in a recent job. I wasn't aware of Clrav -- thanks
for pointing it out. I don't generally use limited removal tools like
Clrav or McAfee Stinger, but if Clrav runs fast, I might.

<AOL> Me, too ! </AOL> Sysclean *use* to identify what Trend terms
grayware before other AV vendors did. Am not finding this the case
lately. KAV will find these and have taken to installing a trial version
of it to make the first pass IF it appears to be a newer variant.


I use F-Prot for Windows as the antivirus program on my main computers
and on my wife's computer. A commercial license is so inexpensive
($50/year for 10 computers) that I sometimes copy it to a client's
computer and run it there. You don't need to install the product --
you can run it from a command prompt, just like F-Prot for DOS, using
the "fpcmd.exe" file. And, unlike the DOS version, it understands
NTFS and long file names.

Thanks for the info on F-Prot.


I sometimes do an on-line scan (McAfee, Trend, Symantec) after running
the installed AV and getting Internet access working.

Don't tell Chris Q. about that

I'm not even going to ask why.

It never hurts to seek a second opinion and that's what online AV
scanners are.

I've had a case where the Symantec on-line scanner found items missed
by multiple AV programs.

BTW, the Microsoft Malicious Software Removal Tool now claims to
remove the Hacker Defender user-mode rootkit. I'm adding it to my
toolbox:

http://www.microsoft.com/security/malwareremove/default.mspx

 

[Steve Wechsler [MVP]]

after approaching senior status, they will retire
and the young generation will start taking over
;-)

The instincts regenerate ? ... I must be infested then

Steve Wechsler (akaMowGreen)
MS-MVP 2004-2005

===============
*-343-* FDNY
Never Forgotten
===============