Teh skruGGleblog

Known as the “computer guy” to my friends and family, I am occasionally asked to do malware cleaning, tune-ups, and routine maintenance on their personal systems. Most infections I have seen are due to unpatched or out of date applications like Adobe Reader, Flash player, or the Java Runtime Environment. The bad guys will craft an exploit, package it in a javascript function, and insert it into random web sites. Then they use search engine optimization and similar techniques to get their google page-rank high enough to be on the first page of search results for current events. Or, they distribute exploits via some other delivery mechanism like email, facebook spam, and instant messages in order to exploit the user directly.

Here is a scenario: A user receives an email with a subject such as “LOL, I can’t believe this is you!!1!” that claims they have attached or linked to a video or photo of the user doing something embarrassing. So as to uphold their pristine reputation, many users will click the link in order to investigate these allegations, only to be told that their flash player is out of date (probably true) and they need to download an update to view the video. The user clicks the provided link, runs the downloaded “update,” and still can’t view the video. More often than not, they will click the link again, to make sure they are good and infected before giving up and going back to harvesting beets in Farmville.

So maybe a couple days, weeks, or months pass, and I get the phone call. “Hey, uh, my computer is REALLY slow and I can’t seem to get to web sites any more. So many pop-ups I am ready to throw this thing out of the window. Would you mind taking a look at it for me?” Begrudgingly, I schedule a time with them to spend some quality time with their computer. I have an arsenal of tools that are free for home use, usually I make sure they are up to date when I am heading to clean a system.

First, I run superantispyware portable, to get the low hanging fruit. A lot of malware these days buries itself in the registry, so once I have run superantispyware (if it finds and deletes anything) I use a tool called CCleaner from Piriform Ltd. to clean up any remnants. It is really easy to use, and will also clear out browser cache, history, etc. so it is a good privacy tool as well. First I clean the disk using the disk analysis portion, then move on to the registry cleaner. I usually run it a couple times, until the analyzer comes back with no results. This will clean the cruft from the registry, and possibly speed up the operating system by itself. After running this, I usually reboot the system to see if there are any errors. Then I run through the steps again to see if anything has returned (which is usually indicative of a more serious infection).

My next step is to assess the antivirus solution they are using. A great product I have been installing lately is actually Microsoft Security Essentials. It is free, and who should know what files belong in the system folders than the OS vendor? A lot of infected computers I see have McAfee or Symantec antivirus trial versions installed, which were never registered or paid for. In these cases, it may be running, but usually wildly out of date on definitions and signatures. This gives the user a false sense of security, since they see it running. After replacing the antivirus solution with Microsoft Security Essentials, I run a full scan to pick up anything that superantispyware was unable to detect and clean. Hopefully it doesn’t find much.

After all of this, I install Secunia Personal Software Inspector, and have it analyze the installed applications. It has a nice friendly interface with a link to the update package for all of the out of date applications installed, and keeps running in order to monitor changes to applications. It has a handy notification icon in the systray (down by the clock) that tells you when something is out of date. This is what I consider the first line of defense, and helps you proactively thwart the bad guys attempts to own your system.

So that is a basic rundown of my malware removal and system optimization process.