Toolkit to fix someone else's malware-infected computer?

[anon]

Hey there,

a relative of mine just called because his work computer got infected. I already have a portable NOD32, Autoruns, APT and ComboFix in my flash drive, for situations like this. Are there any other useful programs you'd recommend?

[yoco]

I always use MalwareBytes

[leechmodder]

A registry cleaner will help after disinfection.
Also, CCleaner portable helps
(CCleaner has a nifty registry cleaner inbuilt)

[Master Razor]

I'm assuming your flash stick is protected against basic autorun virus.
All your executables on that drive should NOT have their default download names. Use random names for them.
Before doing any scanning with malwarebytes , combofix etc. you should disable all virtual cd/dvd drivers on your system (ie. disable emulation). You can do this by running DeFogger.

For diagnostic purposes, you should take a look at OTL OldTimer's List-It. It is used mostly for logging all services, programs, recent files created/installed etc. but it can also be used to clean infected files. You'll need to learn how to use it though.

For diagnostics you could also use DDS and hijackThis. Excelent way to be 100% all infections have been cleaned.

[anon]

I'm assuming your flash stick is protected against basic autorun virus.

Yes, I created hidden folders which have the usual filenames (autorun.inf, copy.exe, etc.) to prevent them from copying. I'll also make a backup of the drive's contents in case something disastrous happens.

All your executables on that drive should NOT have their default download names. Use random names for them.

I didn't think of that!

Before doing any scanning with malwarebytes , combofix etc. you should disable all virtual cd/dvd drivers on your system (ie. disable emulation). You can do this by running DeFogger.

For diagnostic purposes, you should take a look at OTL OldTimer's List-It. It is used mostly for logging all services, programs, recent files created/installed etc. but it can also be used to clean infected files. You'll need to learn how to use it though.

For diagnostics you could also use DDS and hijackThis. Excelent way to be 100% all infections have been cleaned.

Thanks a lot! To you and the others for your suggestions.

I'm also adding the Pocket Killbox to my list. It can come very handy to remove nasty files.

[Master Razor]

DONE! This will create an undeleteable autorun.inf folder in the root of your stick. I changed the ACL to deny every user (included built-in admin and system) the ability to: write, change, add, edit any file inside the autorun.inf. It will appear as the control panel.

You need to change the drive letter in call :mkautorun F:\autorun.inf

I did this script a long time ago (when I had the batch skill of a 3 year old) but I've corrected it now. Hope it works right (it should). Keep in mind: once the autorun.inf is created you cannot delete it from windows. You'll have to boot a live os or something to delete it.

@echo off
setlocal enabledelayedexpansion
call :mkautorun F:\autorun.inf
goto :end

:mkautorun
REM =====================================================================
REM   Purpose: Creates an autorun.inf folder.
REM   Usage:  
REM            CALL :mkautorun %1
REM            %1 - drive letter and path to inf
REM =====================================================================
md %1
cd /d %1
md .\con\
md .\Nul.protected\
echo.[.ShellClassInfo]>%1\Desktop.ini
echo.CLSID={21ec2020-3aea-1069-A2dd-08002b30309d}>>%1\Desktop.ini
attrib.exe +s +h +r %1
icacls.exe /t /deny everyone:(D,DC,WEA,WDAC,WA,AD,WD)>nul 2>&1
goto :eof

:end
endlocal
exit

[Blocker]

A decent antivirus is just enough IMO !

[anon]

Well, the problem was/is random cold reboots, but it turns out the computer wasn't infected. It wasn't high temperature either, as the processor and motherboard stood at around 30°C. There's just so much stuff that can be blamed for this - bad drivers, faulty RAM, maybe a screwed up disk...

[leechmodder]

Dead GPU, Power supply, faulty connections....could be a number of things. It's a matter of process of elimination now.
I always hate when it comes to hardware fault. You always end up having to spend money :(

[Master Razor]

Try to unplug all the cables from the front panel of the case. And start the pc using a screwdriver to connect the two power pins.

[anon]

Dead GPU, Power supply, faulty connections....could be a number of things. It's a matter of process of elimination now.
I always hate when it comes to hardware fault. You always end up having to spend money :(

Ditto. I had a bad story with a power supply last year...

Try to unplug all the cables from the front panel of the case. And start the pc using a screwdriver to connect the two power pins.

Will try that next time I go. Disabling automatic reboots in case it's a driver problem may also help.

[Master Razor]

I doubt the problem is coming from the os. The problem is somewhere on the hardware part.
If it was a faulty ram the bios should beep x times or not boot at all. If it were a dead GPU then the the display wouldn't start. Power supply? Maybe
I had a two computers that had the same symptoms and everytime it was either the button on the case or the cable itself. Somewhere along the cable there's a breach and it is shortcutting randomly. Pc starts/stops unexpectedly and reboots unexpectedly.

[leechmodder]

If it were a dead GPU then the the display wouldn't start.

If the GPU failed, the PC could start on VGA(depending on the failure,very possible) and when you install the drivers, it could restart your PC.


Anon, as Master Razor said, software fault is not likely but just to rule it out, I'd take a backup, format my system and start from scratch. Best of Luck with it.

[Gapo]

Still need some good tools?

X-Ray: Automated Submission of Suspicious Files to Virus Analyst

Integrate Multiple Antivirus Rescue Disk into One Single Disc or USB Flash Drive with SARDU

[guybrush]

the best tools ive found are malwarebytes and superantispyware. spybot still is good at times as well.