Discussion on:

Message 46 of 152
0 Votes
+ -
SysRecue
I've used the same technique with great success using SysRecue, a Linux kernel built through Gentoo. Not only have I used it to access unbootable systems to copy important data, I've also used it to remove dll's, exe's, and other malware-set files. Especially where the date of infection is known, but also through experience of file names (that, and using google), I can remove files that otherwise are difficult to remove.
Although I've used SDFix and some other removal tools, MBAM is the best I've found and their price for a commercial license is reasonable.
To aid in protecting networks, I also implement OpenDNS. Certainly not a 100% fix, but it does help in preventing access to known and listed malware sites. It's amazing the number of times I see their trademark string of numbers in banner ads of everyday sites such as msn.com. I've even seen blocks at a number of technology related sites (not all of which are malware related blocks).
Some other very useful tools are: HiJackThis, SysInternals ProcExplorer (and other SysInternal tools)and some of the online scanning engines.
What amazes me is that one day it took me 4 hours to get to the root of an AV360 problem (a backdoor trojan had whacked the computer with a TDSS tweak and a root kit) and almost the next day a similar hit by AV360 on another machine was resolved in under an hour. The second machine was got to early on, fortunately.
Synopsis: learn to use a number of tools; investigate ANY tool by visiting known, quality forums for information.
Posted by dfoote@...
9th Feb 2009