Tools to clear a virus outbreak

[Morvai]

Hi all.

Tomorrow I've got to go to a customer (a company of approximately 20 - 25 users) where a virus outbreak has wreaked havoc on the entire network.

My job is to go in and rescue the poor guys ;-)

They already use Symantec as a virus scanner and I'll bring Stinger to back it up (since Symanct obviously overlooked something)....

But are there any more tools as convenient and trustworthy as Stinger to help clear out this mess?

Any help would be much appreciated.

[thehorse13]

Symantec Corp addition has about 5 different sigs levels available that range from crappy liveupdate all the way to the most aggresive rapid release. Check to see what happens with a rapid release signature. Go to the site and DL the sigs. This may take care of the issue very quickly.

--TH13

[Morvai]

I did not know about this... I figured with the live update you'd be up to date...

Thanks! I'm looking for those rapid release updates right now. I hope I it'll turn out well.

[nihil]

Try to scan in safe mode if possible, as you will have a better chance of getting rid of stuff that runs on startup.

Also you might look at these:

http://www.ewido.net/en/

http://www.emisoft.com/en/software/free/

Remember it might not be a "virus" as such.

[hesperus]

To get a handle on unwanted processes :

Starter v. 5 -- Shows you what starts with windows and lets you toggle/delete them.

Hijack This -- Old standby. Displays and disables processes. Can use with a parser like http://hjt.iamnotageek.com/.

Maybe its just me, but you sound a little like you are heading into the deep jungle with not much more than a can of bug spray. Good luck in any case.

[Und3ertak3r]

Why Use Stinger? it has not been updated since May of this year?

Goto Trend Micro and d/l Sysclean - and you had better get the pattern file as well

And follow nihils advice..

[XTC46]

also...unplug the comps from the network if possible. otherwise you are just going to scan a few computers, and then they will be reinfected by the time you get to the last one.


dont use stinger, as undertaker said, its far out of date. and dont just scan for viruses, chances are thats not their only problem.

[ElDesperado]

Well, personally I use AVG Free and Avast!, I like Avast because it will do a boot up scan, so it'll get anything before windows loads it, it will also abort connections on the internet that try to download trojans. And when I run AVG I always do it in safe mode (when I know there are viruses), same with Hijackthis. So I'd probably, Run Avast!, load up hijackthis, take off everything that shouldnt be there, restart in safe mode and run AVG. Seemed to work pretty well in the past.

[Morvai]

Thanks for all the quick replies guys.
I've added sysclean AVG and Avast! to my kit.

Both hijackthis and AdAware were already in it to scan for spyware.

Thanks again. It's time to enter the jungle...

Morvai.

[Und3ertak3r]

Seems hesperus may have inadvertantly pasted the wrong link above.. the prog he mentions should be this one..
http://www.snapfiles.com/get/starter.html