[27869] in resnet
Re: Removing "fake" AV?
daemon@ATHENA.MIT.EDU (Hulley, Thomas)
Fri Jul 27 13:13:19 2012
Content-Language: en-US
Content-Type: multipart/alternative; boundary="_000_CC38427D2CD6thulleychoateedu_"
MIME-Version: 1.0
Message-ID: <CC38427D.2CD6%thulley@choate.edu>
Date: Fri, 27 Jul 2012 13:11:48 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: "Hulley, Thomas" <thulley@choate.edu>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <596DB361C21F7647911E35816DE8528A24042D3D@Mail3Node2.ad.uams.edu>
--_000_CC38427D2CD6thulleychoateedu_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
I like to use 2 free utilities for removing fakeAV
Kaspersky rescue CD
BitDefender rescue
They update automatically when you run them so you have the latest definiti=
ons.
You can make a bootable USB drive and do a complete scan. One of both of t=
hese usually cleans any virus. As long as the virus didn't do any permanent=
damage, that=92s all you need.
A scan takes a long time on a large hard drive. The nice thing is they have=
a linux based GUI and file manager so I usually go and delete all the temp=
files on the C drive before the scan to speed things up.
Tom Hulley
Choate Rosemary Hall
From: <Butler>, Kevin D <butlerkevind@uams.edu<mailto:butlerkevind@uams.edu=
>>
Reply-To: Resnet Forum <RESNET-L@LISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.N=
D.EDU>>
To: "RESNET-L@LISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.ND.EDU>" <RESNET-L@L=
ISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.ND.EDU>>
Subject: Re: Removing "fake" AV?
In addition to the aforementioned tools below, I have had rather good succe=
ss using the former ERD Commander tools that Microsoft has rebadged as DaRT=
(Diagnostics and Recovery Toolset - http://www.microsoft.com/en-us/windows=
/enterprise/products-and-technologies/mdop/dart.aspx), which is a component=
of the Microsoft Desktop Optimization Pack available in my TechNet subscri=
ption. The built-in malware scanner in addition to the inclusion of AutoRu=
ns from the former SysInternals Suite are very beneficial in removing malwa=
re. If you have not played with it, I would suggest you give it a try somet=
ime. Currently, the different versions depending on the afflicted OS in que=
stion are (if I am not mistaken):
Windows 2k/XP =96 DaRT v5.0
Windows Server 2008 (RTM-SP2)(x86/x64)/Vista (x86/x64)(RTM-SP2)) =96 DaRT v=
6.0
Windows Server 2008 R2 (RTM)(x64)/ 7(RTM)(x86/x64) =96 DaRT v6.5
Windows Server 2008 R2 SP1 (x64)/ 7 SP1 (x86/x64) =96 DaRT v7.0
These disks have saved my hindquarters (and the end users I support) on man=
y an occasion. Give them a try.
Kevin D. Butler, MCP, MCTS
Data Security Analyst - Senior
University of Arkansas for Medical Sciences<http://www.uams.edu/>
IT Technical Security Department
4301 West Markham, Slot #802
Little Rock, Arkansas 72205
(501) 526-6391 Wk
(501) 405-8240 Pgr
(501) 772-3971 Cell
" I say we take off, and nuke the entire site from orbit. It's the only way=
to be sure."
Lt. Ellen Ripley, Hadley's Hope, Planet LV-426
From: Resnet Forum [mailto:RESNET-L@LISTSERV.ND.EDU] On Behalf Of Lyons, An=
drew H
Sent: Saturday, July 21, 2012 6:52 PM
To: RESNET-L@LISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.ND.EDU>
Subject: Re: [RESNET-L] Removing "fake" AV?
Caroline,
We typically use SuperAntispyware, MalwareBytes, and whatever AV software t=
hey have, assuming it is current. A quick scan with each in Safe Mode then =
normal boot usually does the trick. We have the steps listed on a log sheet=
the student techs use for each session, to be sure they keep track.
Andrew
ITS Helpdesk
University at Albany
-----Original message-----
From: Caroline Couture <caroline@pobox.upenn.edu<mailto:caroline@pobox.upen=
n.edu>>
To: "RESNET-L@LISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.ND.EDU>" <RESNET-L@L=
ISTSERV.ND.EDU<mailto:RESNET-L@LISTSERV.ND.EDU>>
Sent: Sat, Jul 21, 2012 20:48:37 GMT+00:00
Subject: [RESNET-L] Removing "fake" AV?
Hi Folks!
What do people like now for removing the various fake av infections out the=
re? I typically use SuperAntiSpyware Portable. I've tested Windows Defender=
Offline but it doesn't seem as good. Does anyone have any instructions the=
y can pass along?
Virus removal is typically something we have more senior student staff memb=
ers do but we are cutting down those positions so we may have to have less =
senior students working on these systems. For the most part dealing with fa=
ke AV infections just seems to be more a matter of devoting the time to hav=
ing the scan complete and perhaps having less senior students work on those=
systems will free up our more experience workers to deal with more complex=
issues.
Take care,
Caroline
"Vulnerability is not weakness. I define vulnerability as emotional risk, e=
xposure, uncertainty. It fuels our daily lives. And I've come to the belief=
-- this is my 12th year doing this research -- that vulnerability is our m=
ost accurate measurement of courage -- to be vulnerable, to let ourselves b=
e seen, to be honest." - Brene Brown
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
Confidentiality Notice: This e-mail message, including any attachments,
is for the sole use of the intended recipient(s) and may contain
confidential and privileged information. Any unauthorized review,
use, disclosure or distribution is prohibited. If you are not the
intended recipient, please contact the sender by reply
e-mail and destroy all copies of the original message.
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_CC38427D2CD6thulleychoateedu_
Content-Type: text/html; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
<html><head>
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DWindows-1=
252"></head><body style=3D"word-wrap: break-word; -webkit-nbsp-mode: space;=
-webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14p=
x; font-family: Calibri, sans-serif; "><div>I like to use 2 free utilities =
for removing fakeAV</div><div>Kaspersky rescue CD</div><div>BitDefender res=
cue</div><div>They update automatically when you run them so you have the l=
atest definitions.</div><div>You can make a bootable USB drive and do a &nb=
sp;complete scan. One of both of these usually cleans any virus. As long as=
the virus didn't do any permanent damage, that=92s all you need.</div><div=
>A scan takes a long time on a large hard drive. The nice thing is they hav=
e a linux based GUI and file manager so I usually go and delete all the tem=
p files on the C drive before the scan to speed things up.</div><div><br></=
div><div>Tom Hulley</div><div>Choate Rosemary Hall</div><div><br></div><div=
><br></div><div><br></div><span id=3D"OLK_SRC_BODY_SECTION"><div style=3D"f=
ont-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BO=
TTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-L=
EFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: =
medium none; PADDING-TOP: 3pt"><span style=3D"font-weight:bold">From: </spa=
n> <Butler>, Kevin D <<a href=3D"mailto:butlerkevind@uams.edu">but=
lerkevind@uams.edu</a>><br><span style=3D"font-weight:bold">Reply-To: </=
span> Resnet Forum <<a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L=
@LISTSERV.ND.EDU</a>><br><span style=3D"font-weight:bold">To: </span> &q=
uot;<a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV.ND.EDU</a=
>" <<a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV.N=
D.EDU</a>><br><span style=3D"font-weight:bold">Subject: </span> Re: Remo=
ving "fake" AV?<br></div><div><br></div><div xmlns:v=3D"urn:schem=
as-microsoft-com:vml" xmlns:o=3D"urn:schemas-microsoft-com:office:office" x=
mlns:w=3D"urn:schemas-microsoft-com:office:word" xmlns:x=3D"urn:schemas-mic=
rosoft-com:office:excel" xmlns:m=3D"http://schemas.microsoft.com/office/200=
4/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html40"><meta name=3D"Generato=
r" content=3D"Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
border:none;
padding:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext=3D"edit">
<o:idmap v:ext=3D"edit" data=3D"1" />
</o:shapelayout></xml><![endif]--><div bgcolor=3D"white" lang=3D"EN-US" lin=
k=3D"blue" vlink=3D"purple"><div class=3D"WordSection1"><p class=3D"MsoNorm=
al"><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: C=
alibri, sans-serif; ">In addition to the aforementioned tools below, I have=
had rather good success using the former ERD Commander tools that Microsof=
t has rebadged as DaRT (Diagnostics
and Recovery Toolset - <a href=3D"http://www.microsoft.com/en-us/windows/e=
nterprise/products-and-technologies/mdop/dart.aspx">
http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies=
/mdop/dart.aspx</a>), which is a component of the Microsoft Desktop Optimiz=
ation Pack available in my TechNet subscription. The built-in malware=
scanner in addition to the inclusion
of AutoRuns from the former SysInternals Suite are very beneficial in remo=
ving malware. If you have not played with it, I would suggest you give it a=
try sometime. Currently, the different versions depending on the afflicted=
OS in question are (if I am not
mistaken):<o:p></o:p></span></p><p class=3D"MsoNormal"><span style=3D"font=
-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><=
o:p> </o:p></span></p><p class=3D"MsoNormal"><span style=3D"font-size:=
11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Windows=
2k/XP =96 DaRT v5.0<o:p></o:p></span></p><p class=3D"MsoNormal"><span styl=
e=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-s=
erif; ">Windows Server 2008 (RTM-SP2)(x86/x64)/Vista (x86/x64)(RTM-SP2)) =
=96 DaRT v6.0<o:p></o:p></span></p><p class=3D"MsoNormal"><span style=3D"fo=
nt-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "=
>Windows Server 2008 R2 (RTM)(x64)/ 7(RTM)(x86/x64) =96 DaRT v6.5<o:p></o:p=
></span></p><p class=3D"MsoNormal"><span style=3D"font-size: 11pt; color: r=
gb(31, 73, 125); font-family: Calibri, sans-serif; ">Windows Server 2008 R2=
SP1 (x64)/ 7 SP1 (x86/x64) =96 DaRT v7.0<o:p></o:p></span></p><p class=3D"=
MsoNormal"><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-fa=
mily: Calibri, sans-serif; "><o:p> </o:p></span></p><p class=3D"MsoNor=
mal"><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: =
Calibri, sans-serif; ">These disks have saved my hindquarters (and the end =
users I support) on many an occasion. Give them a try.<o:p></o:p></span></p=
><p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; color: rgb(31, 7=
3, 125); font-family: Calibri, sans-serif; "><o:p> </o:p></span></b></=
p><p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; color: rgb(31, =
73, 125); font-family: Calibri, sans-serif; ">Kevin D. Butler, MCP, MCTS<o:=
p></o:p></span></b></p><p class=3D"MsoNormal"><b><span style=3D"font-size: =
11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">Data Sec=
urity Analyst - Senior<o:p></o:p></span></b></p><p class=3D"MsoNormal"><spa=
n style=3D"font-size:11.0pt;font-family:"Calibri","sans-seri=
f";color:#1F497D"><a href=3D"http://www.uams.edu/"><b><span style=3D"c=
olor:blue">University of Arkansas for Medical Sciences</span></b></a></span=
><i><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: C=
alibri, sans-serif; "><o:p></o:p></span></i></p><p class=3D"MsoNormal"><b><=
i><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Cal=
ibri, sans-serif; ">IT Technical Security Department</span></i></b><i><span=
style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, s=
ans-serif; "><o:p></o:p></span></i></p><p class=3D"MsoNormal"><b><span styl=
e=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-s=
erif; ">4301 West Markham, Slot #802<o:p></o:p></span></b></p><p class=3D"M=
soNormal"><b><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-=
family: Calibri, sans-serif; ">Little Rock, Arkansas 72205<o:p></o:p></span=
></b></p><p class=3D"MsoNormal"><b><span style=3D"font-size: 11pt; color: r=
gb(31, 73, 125); font-family: Calibri, sans-serif; ">(501) 526-6391 Wk<o:p>=
</o:p></span></b></p><p class=3D"MsoNormal"><b><span style=3D"font-size: 11=
pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; ">(501) 405-=
8240 Pgr<o:p></o:p></span></b></p><p class=3D"MsoNormal"><b><span style=3D"=
font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif;=
">(501) 772-3971 Cell<o:p></o:p></span></b></p><p class=3D"MsoNormal"><spa=
n style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, =
sans-serif; "><o:p> </o:p></span></p><p class=3D"MsoNormal"><b><i><spa=
n style=3D"font-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, =
sans-serif; ">" I say we take off, and nuke the entire site from orbit=
. It's the only way to be sure."<o:p></o:p></span></i></b></p><p class=
=3D"MsoNormal"><b><span style=3D"font-size: 11pt; color: rgb(31, 73, 125); =
font-family: Calibri, sans-serif; ">Lt. Ellen Ripley, Hadley's Hope, Planet=
LV-426<o:p></o:p></span></b></p><p class=3D"MsoNormal"><span style=3D"font=
-size: 11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><=
o:p> </o:p></span></p><p class=3D"MsoNormal"><span style=3D"font-size:=
11pt; color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p>&n=
bsp;</o:p></span></p><p class=3D"MsoNormal"><span style=3D"font-size: 11pt;=
color: rgb(31, 73, 125); font-family: Calibri, sans-serif; "><o:p> </=
o:p></span></p><div><div style=3D"border:none;border-top:solid #B5C4DF 1.0p=
t;padding:3.0pt 0in 0in 0in"><p class=3D"MsoNormal"><b><span style=3D"font-=
size: 10pt; font-family: Tahoma, sans-serif; ">From:</span></b><span style=
=3D"font-size: 10pt; font-family: Tahoma, sans-serif; "> Resnet Forum [<a h=
ref=3D"mailto:RESNET-L@LISTSERV.ND.EDU">mailto:RESNET-L@LISTSERV.ND.EDU</a>=
]
<b>On Behalf Of </b>Lyons, Andrew H<br><b>Sent:</b> Saturday, July 21, 2012=
6:52 PM<br><b>To:</b> <a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L=
@LISTSERV.ND.EDU</a><br><b>Subject:</b> Re: [RESNET-L] Removing "fake&=
quot; AV?<o:p></o:p></span></p></div></div><p class=3D"MsoNormal"><o:p>&nbs=
p;</o:p></p><div><p class=3D"MsoNormal">Caroline,<br><br>
We typically use SuperAntispyware, MalwareBytes, and whatever AV software t=
hey have, assuming it is current. A quick scan with each in Safe Mode then =
normal boot usually does the trick. We have the steps listed on a log sheet=
the student techs use for each
session, to be sure they keep track.<br><br>
Andrew<br>
ITS Helpdesk<br>
University at Albany<span style=3D"font-family: Arial, sans-serif; "><o:p><=
/o:p></span></p></div><p class=3D"MsoNormal"><br><br>
-----Original message-----<o:p></o:p></p><div><p class=3D"MsoNormal" style=
=3D"margin-bottom:12.0pt"><b><span style=3D"font-size: 10.5pt; font-family:=
Arial, sans-serif; ">From:
</span></b><span style=3D"font-size: 10.5pt; font-family: Arial, sans-serif=
; ">Caroline Couture <<a href=3D"mailto:caroline@pobox.upenn.edu">caroli=
ne@pobox.upenn.edu</a>><b><br>
To: </b>"<a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@LISTSERV=
.ND.EDU</a>" <<a href=3D"mailto:RESNET-L@LISTSERV.ND.EDU">RESNET-L@=
LISTSERV.ND.EDU</a>><b><br>
Sent: </b>Sat, Jul 21, 2012 20:48:37 GMT+00:00<b><br>
Subject: </b>[RESNET-L] Removing "fake" AV?<o:p></o:p></span></p>=
</div><div><div><div><p class=3D"MsoNormal" style=3D"margin-bottom:12.0pt">=
<span style=3D"font-size:10.0pt">Hi Folks!<br><br>
What do people like now for removing the various fake av infections out the=
re? I typically use SuperAntiSpyware Portable. I've tested Windows Defender=
Offline but it doesn't seem as good. Does anyone have any instructions the=
y can pass along?<br><br>
Virus removal is typically something we have more senior student staff memb=
ers do but we are cutting down those positions so we may have to have less =
senior students working on these systems. For the most part dealing with fa=
ke AV infections just seems to be
more a matter of devoting the time to having the scan complete and perhaps=
having less senior students work on those systems will free up our more ex=
perience workers to deal with more complex issues.<br><br>
Take care,<br>
Caroline<br><br><br>
"Vulnerability is not weakness. I define vulnerability as emotional ri=
sk, exposure, uncertainty. It fuels our daily lives. And I've come to the b=
elief -- this is my 12th year doing this research -- that vulnerability is =
our most accurate measurement of courage
-- to be vulnerable, to let ourselves be seen, to be honest." - Brene=
Brown<br><br>
___________________________________________________<br>
You are subscribed to the ResNet-L mailing list.<br><br>
To subscribe, unsubscribe or search the archives,<br>
go to <a href=3D"http://LISTSERV.ND.EDU/archives/resnet-l.html" target=3D"_=
BLANK">http://LISTSERV.ND.EDU/archives/resnet-l.html</a><br>
___________________________________________________<o:p></o:p></span></p></=
div></div></div></div><p>Confidentiality Notice: This e-mail message, inclu=
ding any attachments,<br>
is for the sole use of the intended recipient(s) and may contain<br>
confidential and privileged information. Any unauthorized review,<br>=
use, disclosure or distribution is prohibited. If you are not the <br=
>
intended recipient, please contact the sender by reply<br>
e-mail and destroy all copies of the original message.</p></div></div></spa=
n></body></html>
___________________________________________________
You are subscribed to the ResNet-L mailing list.
<p>
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
--_000_CC38427D2CD6thulleychoateedu_--
