psloss
Premium
join:2002-02-24
Alpharetta, GA
| reply to CTS
Re: Has anyone ever fixed malware/spyware thru' Ba
Yes; if I have physical access to the computer (a real console session), it's the fastest way to regain control of the computer away from "commercial" malware. (Malware that is not targeting specific individuals.)
Since the first step in removal is to stop the software from running, BartPE or WinPE or a Knoppix CD accomplishes that step on startup.
The next step is to prevent future operation and while it is harder to see the offline Registry hives without using something like RegEditPE, you can delete the files themselves first. For example, with a kernel driver, deleting the executable is just as effective as removing the SCM entry from the currently selected control set.
So given a UBCD "distro" or a Knoppix CD with the ability to drive an anti-virus scan (either online or off), you could scan/clean all the disk volumes (hard drives) on the computer first, and then boot back into the infected OS and run additional scans to clean Registry and other related data files.
This is something (BartPE compatibility) I really want to add to our embryonic scanner.
Philip Sloss
--
Feedback? e-mail: stuff@lupwa.org |
