{"id":1815,"date":"2011-06-18T16:00:36","date_gmt":"2011-06-18T16:00:36","guid":{"rendered":"http:\/\/really.zonky.org\/?p=1815"},"modified":"2011-06-19T12:04:36","modified_gmt":"2011-06-19T12:04:36","slug":"pc-malware-handling","status":"publish","type":"post","link":"https:\/\/really.zonky.org\/?p=1815","title":{"rendered":"PC Malware Handling"},"content":{"rendered":"

This is a series of notes on dealing with PC malware (viruses, worms and the like) gathered because I’m looking into it and published as a way of reminding myself about this stuff. Bear in mind that I’m not an expert but neither am I a complete dunce – I’m normally a Unix or Linux person but I’ve been keeping half an eye on Windows infections for years.<\/p>\n

Some links to tools are contained within. However you should be aware that tool recommendations change over time; you will need to check how outdated this document is before following any recommendations blindly.<\/p>\n

At present this blog entry is a work in progress … lots of testing needs to be done before being confident this is right.<\/p>\n

Cleanup Process<\/h2>\n

This is not :-<\/p>\n

    \n
  1. How to approach this forensically – if you’re dealing with an investigation, it’s a whole other ball game and you probably need professional assistance to avoid corrupting evidence.<\/li>\n
  2. A technical guide as to which tools to use.<\/li>\n<\/ol>\n

    1. For The Ultra Cautious Or When Handling Real Important Data<\/h3>\n

    The process of removal can be destructive, and in the worst cases you can end up cleaning the malware and ending up with a brick. So make an image of the hard disk as it is. Two basic ways this can be done :-<\/p>\n

      \n
    1. Removing the hard disk from the infected machine, attaching to an appropriate machine (USB->SATA, USB->IDE\u00a0converters are handy here), and making an image of the disk.<\/li>\n
    2. Booting off a “rescue” CD on the infected machine, and imaging the hard disk to a network share of some kind. This is the preferred option.<\/li>\n<\/ol>\n

      This will be slow<\/em>. So be it. Cleaning an infected PC is not going to be a quick job whatever you do. The best you can hope for is that there are many periods where you can leave it churning away and get on with something else.<\/p>\n

      2. Boot A Rescue CD<\/h3>\n

      There are those who tell you that there is no need to boot off a known uninfected disk to clean an infected machine; their anti-malware\/virus product can clean an infected machine “live”. There are others who claim that the only way to be sure is to boot off that disk and clean the machine that way. Both are wrong.<\/p>\n

      If you are paranoid (and in the presence of malware paranoia is fully justifiable), you will do both.<\/p>\n

      3. Boot Infected Machine and Clean<\/h3>\n

      As suggested previously after booting off a rescue disk and cleaning, boot the infected machine and clean again.<\/p>\n

      Tools<\/h2>\n

      The following is a list of rescue CD’s that have been suggested :-<\/p>\n