Looks like I may have to go hunting a virus or trjan on a friends laptop ....and was thinking how would the experts go about it (I suppose the experts wouldn't get one in the first place) but if a step by step guide could be worked out on here I am sure it would help others

TIA

I'm far from expert - but using the freeware spybot search and destroy seems to work in finding most stuff.

:+1:

Spybot S&D is a good starting point. Do you know what you're looking to remove yet, or is it a case of doing a general search because there may be general nasties lurking in the background and slowing system performance down?

Steve

malwarebytes antimalware, but rename the executable before you run it as some trojans block the standard named .exe from running

Looks like I may have to go hunting a virus or trjan on a friends laptop ....and was thinking how would the experts go about it (I suppose the experts wouldn't get one in the first place) but if a step by step guide could be worked out on here I am sure it would help others

TIA

Back up documents.

Wipe laptop and reinstall windows.

It will usually be a fair bit quicker and much less stressful than trying to get a malware infested laptop clear and working at a decent speed again.

Use an online scanner such as Panda or Trend housecall.

Anything loaded on the machine cannot be trusted to find an infection if one is present - especially nasty stuff.

Most viruses kill malware and AV scanners, as well as disabling your software firewall. *some* concept viruses have also managed to access and disable router firewalls where an infected machine has the username and password stored, or kept at default.

As mentioned above, i would 1st download and run, Malwarebytes Antimalware (MBAM)

Then i reckon it would be worth running a scan with either (or both) Spybot or Adaware - Both are free software.

For all software mentioned above, make sure you update the definitions before scanning.

After you've run those, you will have a good chance that you may have got rid of the problem....... Then, i would run an online virus scanner, as mentioned above, both Panda and Trendmicro Housecall are good..... Infact, i would run both scans one after the other..... some scanners pic up things that others miss, so worth doing both.

If all comes back clear, i would then update and then run a scan using the computers installed antivirus software and finally i would download Hijackthis and run a scan with that and post up a copy of the log on their forums and ask a moderator to take a look and see if they can see anything nasty in the log. They will then tell you how to go about removing anything that shouldn't be there.

Hope that helps.

Steve

malwarebytes antimalware

adaware

spybot

panda antivirus scan

trendmicro housecall online antivirus scan

edit to add: Oh, and to add to what i said..... Also turn off system restore before you start, delete the old restore points, then once you know you are clean, turn it back on and make a new restore point.

Edited 1 April, 200917 yr by steve75

As mentioned it'll probably be easier to backup and reformat.

Lots of these nasties are very clever and can be real headache to kill off even when you know what you are doing.

ASquared make a good product freebie if you want to have a go.

I'd go with:-

1) Quarantine the machine.

2) Download 2 free scanners on another machine, and create executable CDRs of them.

3) Use those on the quarantined machine.

Oh, and to add to what i said in my last post..... Also turn off system restore before you start, delete the old restore points, then once you know you are clean, turn it back on and make a new restore point.

If you don't know exactly what you are doing or looking for (which i'd say you don't from your first post) and sometimes even if you do know what you're doing, then if the machine is ridden with cruft to the point you've noticed it then it's probably format and reinstall time.

If you don't know exactly what you are doing or looking for (which i'd say you don't from your first post) and sometimes even if you do know what you're doing, then if the machine is ridden with cruft to the point you've noticed it then it's probably format and reinstall time.

Indeed. Even with lots of experience, it's sometimes the only way to go. Lots of malware will respawn itself unless you are very careful.

Is this a case of you know your infected, or being paranoid that you could be?

Rob - It's all down to if the user knows if they have or haven't got a Virus/Trojan/Malware.

If your unsure about what you are doing - I have some free time this week. I'm more than willing to help you.

It's all dependant on how much effort your willing to go into. If you know what the problem is then take some steps from above with software solution.

I would however suggest a simple back-up and that you re-install windows.

Hope this helps,

Rob

Take off and nuke the site from orbit... It's the only way to be sure..

Easy uninstall all antivirus and spyware software then download NOD32 30 day free trial and do a full scan. I suppose you could then purchase a 12 month licence as a thank you to ESET.

Still, no guarantee that NOD32 will completely clean the machine. It's good, but it can't work miracles.

Steve

He's not brought it over yet.......but from what I can make out...he has sort of antivirus package on it (maybe norton or something).....but is convinced that his laptop is not right and it is "doing weird things"......I'll have a look when he brings it but no way is it joining my network to download anything

Probably full of 'legitimate' junk along with the malware.

Nuke, reformat, patch and image if you can.

Still, no guarantee that NOD32 will completely clean the machine. It's good, but it can't work miracles.

Steve

Well worth trying before you go for a complete reformat however.

Easy uninstall all antivirus and spyware software then download NOD32 30 day free trial and do a full scan. I suppose you could then purchase a 12 month licence as a thank you to ESET.

But as I've said, IF the machines infected, what ever you load on it the nasty *could* disable. It's now a fundamental part of writing nasties - protect form being removed.

If you load Nod, the nasty could see it, nuke it and everything appears fine.

The amount of machines I'ves seen that does this means my advise is use an online scanner BEFORE loading any new AV or malware removal software. This should ensure the machine is free from anything that would disable it, or tell you what it is so you can manually remove/block.

But as I've said, IF the machines infected, what ever you load on it the nasty *could* disable. It's now a fundamental part of writing nasties - protect form being removed.

If you load Nod, the nasty could see it, nuke it and everything appears fine.

The amount of machines I'ves seen that does this means my advise is use an online scanner BEFORE loading any new AV or malware removal software. This should ensure the machine is free from anything that would disable it, or tell you what it is so you can manually remove/block.

Personally, i see things differently.......

To me, it makes more sense to download some malware removal software and run that first, then scan via an online scanner.

My theory being, it takes just a couple of minutes to download those programs, install them then update them. Then, you can disconnect from the internet all together, and run your scans. These can take quite a while if you have a lot of stuff on your drives, and personally i'd rather not be connected to the net while a trojan/virus is potentially sending or receiving private information from my machine......

So, if there is a chance that malware software can remove completely (or partially) any nasties first, whilst i'm offline and before running an online scan, where you are connected to the net for quite along time, then i'd rather try that first rather than find that, during the couple of hours it's taken for 'housecall' to do a scan, the virus has been spewing out private info and passwords from my machine.......

Is it only me that that makes sense to?

On the other hand, as somebody said....... If you haven't got much stuff on the computer, or it is all backed up anyway, then it's probably just easier and safer to do a reinstall.

If it's been infected and you can't prove it's 100% clean would you use online banking or buy anything with a card using it?

Back up. Download updates, download antimalware, unplug from router, reformat, apply antimalware, go back online, run updates to see if you've missed anything.

It's important to have a firewall and AV in place before you go back online. I had a machine reinfected before I was able to download the firewall to stop it.

Is it only me that that makes sense to?

Yup.

A rootkit for example will disable anything on sight usually. You start loading AVG lets say, it sees it and to preserve it'self disables it whilst you're still installing it. Scan you then run returns a clean machine, so off you go banking, buying stuff etc as the nasty remains collecting your data and piping it back to someone in eastern europe.

If you think it's a fine way to run, that's your call. But I wouldnt trust such a mchine for anything other than surfing.

I base my info on a friend who does this for a living 9as in deleratly infecting his test rigs), and runs the website www.vitalsecurity.org to educate others

Well thanks for the education.... Interesting stuff. Good to learn something new, but now I'm feeling paranoid :-s