10

If you have ever tried to search for "How do I get rid of ________?", any results that appear in Google always give the answer "Just download and install the shady anti-virus software ________!"

Often I want to know how to manually get rid of certain malware (knowing which processes to kill, which registry keys to remove, which binaries to delete, which startup processes to disable, etc).

Are questions along the lines of "How do I manually get rid of malware ________?" on topic for this site? If not, is there another StackExchange site, or at least another place on the internet, where such questions can be asked?

6

Those ones are unlikely to ever be on topic here, as they are very specific, and the correct place to go for them already exists:

  • the anti-malware and anti-virus vendors websites

If you go to one of them and use their search, you typically get very detailed guidance on removal and checking.

Here we would focus much more on the enterprise security implications of malware, where individual removal of a particular piece of malware is less relevant (in most cases a wipe and rebuild/reinstall is the appropriate course) and the risks that need to be addressed are around the wider impact on the enterprise.

  • 5
    Do you have an example of such a "anti-virus vendor website" that contains such detailed information? All I can find is "Click here to download our software, and we will magically make the problem go away!!" – IQAndreas Feb 4 '14 at 0:13
  • Sure - all the top vendors have them. A quick example here. Click on the Removal instruction tab: home.mcafee.com/VirusInfo/VirusProfile.aspx?key=6176714#none – Rory Alsop Feb 4 '14 at 8:45
  • 2
    "Run a full system scan. (On-Demand Scan)" Doesn't seem like a manual instruction at all. – user510083 Feb 4 '14 at 23:00
  • Okay - that one was a bad example, as it is easily removed. – Rory Alsop Feb 5 '14 at 8:47
4

I think you need a malware report/summary that describes about all activities and malicious actions of this malware. So first you need to identify this malware by an antivirus/malware scanner online services (virustotal.com or google for another one) or search md5 of this file.

enter image description here

enter image description here

After you get the malware description (name, class ... in my case is w32.virus.cf), you just google it to get the malware activity summary (the result maybe in a security forums, antivirus vendor website, malware blogs ...)

If the previous guide is not active, you can try to upload the malware file to a sandbox like threatexpert and wait to get the analyzing result!

enter image description here

Hope this helpful!

0

I know I'm new, but my suggestion would be either: A) Create a subsite for malware removal questions or B) Redirect users to a forum/site like Bleeping Computer that really does specialize in that area, has a variety of tools available, and knowledgeable experts to help out.

Personally, I'd lean towards B) if and only if users are explicitly directed to a known forum or site that offers reputable, cost-free help.

  • We are unlikely to make recommendations like that, as the best site may change over time, and may be different for different users. These types of site can be googled. – Rory Alsop Feb 27 '14 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .