3.3 - Removing Malware

Question 1

Malware removal

Answer 1

• This is almost never the best practice
  – It’s impossible to know if all of the malware
  has been removed
• Ideally, you should delete everything and start over
  – Restore from a known-good backup
  – Install from the original media
• There are reasons to remediate
  – Important user documents may need to be recovered
  – Get the system running well enough to
  backup certain files

Question 2

1. Verify malware symptoms

Answer 2

• Odd error messages
  – Application failures, security alerts
• System performance issues
  – Slow boot, slow applications
• Research the malware
  – Know what you’re dealing with

Question 3

2. Quarantine infected systems

Answer 3

• Disconnect from the network
  – Keep it contained
• Isolate all removable media
  – Everything should be contained
• Prevent the spread
  – Don’t transfer files, don’t try to backup
  – That ship sailed

Question 4

3. Disable System Restore

Answer 4

• Restore points make it easy to rewind
  – Malware infects restore points
• Disable System Protection
  – No reason to save an infected config
• Delete all restore points
  – Remove all infection locations

Question 5

4a. Remediate: Update anti-virus

Answer 5

• Signature and engine updates
  – The active anti-virus engine
  – Signature updates
  – A very, very tiny shelf life
• Automatic vs. manual
  – Manual updates are almost pointless
• Your malware may prevent the update process
  – Copy from another computer

Question 6

4b. Remediate: Scan and remove

Answer 6

• Microsoft and others - The big anti-virus apps
• Malware-specific -
  – Scan and remove difficult malware
• Stand-alone removal apps
  – Check with your anti-virus company
• There’s really no way to know if it’s really gone
  – Delete and rebuild
• Safe mode
  – Load the bare minimum operating system
  – Just enough to get the OS running
  – Can also prevent the bad stuff from running
• Pre-installation environment (WinPE)
  – Recovery Console, bootable CD/DVDs/USBs
  – Build your own from the Windows
  – Assessment and Deployment Kit (ADK)
• May require the repair of boot records and sectors

Question 7

5. Schedule scans and run updates

Answer 7

• Built into the antivirus software
  – Automated signature updates and scans
• Task scheduler
  – Run any task
• Operating system updates
  – Make sure its enabled and working properly

Question 8

6. Enable System Protection

Answer 8

• Now you’re clean
  – Put things as they were
• Create a restore point
  – Start populating again

Question 9

7. Educate the end user

Answer 9

• One on one
  – Personal training
• Posters and signs
  – High visibility
• Message board posting
  – The real kind
• Login message
  – These become invisible
• Intranet page
  – Always available