Virus and Malware Removal

Over the Years BOS has developed a very thorough seven step method for ridding our clients computers of Malware/Virus Infections and protecting them against additional Infection:

1. Gain control of the machine: With the increasing sophistication of the current crop of Bad Guys, control of the machine is an essential pre-requisite for detecting and removing malicious software. Failure or ignorance of how to implement this critical step allows the bad guys to protect themselves from nearly any removal technique or to be able to re-install themselves soon after the computer is connects to the internet. Failure here is also the main reason that the less able technicians will resort to "Wipe and Re-install Windows" as the only solution. It is more likely that it is all that the technician knows to do and can force the user to re-install all of their applications and peripheral devices and take a chance on losing all of the data they don't have reliable backups for. Gaining control of the computer is where BOS excels.

2. Remove the First Layer of Malware: The Bad Guys that you see are more often than not just the first layer of infection. In describing this problem BOS considers two types of Bad Guys, Good Bad Guys and Bad Bad Guys. Bad Bad Guys generally are not good enough programmers to hack into your computer and are not subtle. They usually get in because of a mistake made by the user or with the assistance of a Good Bad Guy. Good Bad Guys are generally very good programmers and smart enough to keep a low profile so that most users will not even notice that they are infected. Once having gained control of your machine, a Good Bad Guys is able to hide from commercial security software.

3. Identify How the Malware Got In: A vector is a Security failure that allows Bad Guys to infect your Computer. Vectors generally fall into one of the three following categories;

   1. User Action/Inaction: Over 70% of Malware infections stem from the user action/inaction vector. Examples of the two sides of this vector are saying yes when asked to allow installation of malicious Active-X controls or change browser security settings while at a malicious or compromised website and failure to update important software such as the operating system, web browser, security software and Java support. Another way that users become vulnerable to this vector is indiscriminate downloading and installation of malicious software.
   2. Undiscovered Vulnerability: Another vector is the undiscovered vulnerability vector. This can relate to the user that is slow in getting updates as some exploits are not created until the Bad Guys see the patch that fixes it. They then reverse engineer a way to take advantage of those that are not quick or fail to get updates altogether.
       
      Sometimes the Bad Guys discover a new way to infect a machine. As time goes on, the frequency which this vector appears is diminishing. Microsoft and other software manufacturers are getting better at providing quick and even zero day updates for discovered vulnerabilities.
   3. Inappropriate Trust: This is a less common but important vector. There are two ways that trust can allow infection to travel between private computers. To make full use of a small office or home network Microsoft's File and Printer Sharing and Client for Microsoft Networks services are installed. When these services are installed the allow additional methods of communication and automatically create a trust relationship between all of the members of the network. This combination of trust and communication allows Bad Guys to do things and go places that you may not have protection against. Another type of inappropriate trust would be via email. Trusting that mom wouldn't send me a virus because she likes me ignores two things, the email may not have really come from mom and mom may not know enough to be aware that it was a Bad Guy that she sent. When this vector goes undetected the user is sure to be re-infected.
   4. Though it adds an extra item here and is not one of the three important vectors of infection, I will also mention the very, very Good Bad Guy. This is a rare thing to see on a personal computer. Bad Guys of this caliber are not likely to consider you important enough to notice let alone spend the time and effort it takes to come and get you. They are out there.

4. Remove Additional Malware:

5. Repair Damage Caused By the Malware:

6. Setup Computer Security According the 'BOS Security Standard'

7. Review the BOS Security Standard With the Client: