On Tue, 25 May 2010, Thane Sherrington wrote:
When a computer comes into the shop, I like to disable the current AV so as to
speed up the scans and prevent two AVs conflicting. I've been disabling the
AV's services, but I've found that when I do that with NIS (surprise, suprise,
it's a piece of crap) then it shuts down access to the internet because it's
firewall is off. Then I end up having to turn the service back on (no small
feat because the PoS tries to prevent changes to it's service settings even
though it's turned off.) Does anyone know of a better way to disable AVs
(especially NIS) without uninstalling so that I can still access the internet?
Yank drive: Plug in USB HDD converter (I have one that does SATA, IDE and
Laptop IDE size plug in one) and scan in a known clean machine. That way
you can have a known clean system doing the scan and won't have to worry
that a rootkit is hiding itself.
I've run into virus's recently that usurp winlogon in win.ini as well as
the explorer.exe shell in the registry.
Hell, once recently even replaced the keyboard driver. Once a machine is
infected it is faster just to yank the drive and scan it externally to a
known good machine.
Multiple advantages to this beyond the rootkit issue.
1: Your scanning machine can scan multiple drives at once
2: Your scanning system will have all your scanning software installed
and up to date
3: No need to install stuff onto the system you're working on. Saving
the install/uninstall time
4: You can delete the hiberfil, pagefile, %windir%\temp, %userdir%\Local
Settings\Temp, etc to speed up scans
5: Using regedit you can load individual registry files and search for
known issues in the registry prior to booting, allowing you to delete crap
from the HKLM\Software\Microsoft\Run, as well as loading the user's HCLU
registry file found in their %userdir%, allowing you to see what might be
loading that shouldn't be.
I never trust a virus scan run on a machine that is already infected. I
do run a Malware scan once I get the machine cleared of virus's on another
machine to finalize the registry portion of the scan.
Christopher Fisk
