Some thoughts/steps for your situation.... if I was the one to deal with the problem....
Quick solution: backup your files, format everything and reinstall. Do a clean installation. Update everything to the latest patches/hotfixes. It will take less time than the other solution.
The other solution......
Prepare/Arm yourself with tools.
- Antivirus Live CDs See here here and here
- Panda USB Vaccine. It's not an AV. It can be used with ANY antivirus you have. See this MS article is you like the manual way better.
The free Panda USB Vaccine can be used on individual USB drives to disable its AUTORUN.INF file in order to prevent malware infections from spreading automatically. When applied on a USB drive, the vaccine permanently blocks an innocuous AUTORUN.INF file, preventing it from being read, created, deleted or modified. Once applied it effectivelly disables Windows from automatically executing any malicious file that might be stored in that particular USB drive. The drive can otherwise be used normally and files (even malware) copied to/from it, but they will be prevented from opening automatically. Panda USB Vaccine currently only works on FAT & FAT32 USB drives. Also keep in mind that USB drives that have been vaccinated cannot be reversed except with a format.
Scan-Clean the PC(s)
- Remove ethernet cable, cut off connectivity (internet-or internal (to the lab)
- Reboot the computer(s) from a GENUINE Antivirus Live CD. See here here and here, for info. Don't download and run them, unless you make sure they are valid/trusted/original/etc. Use common sense. Prepare your OWN from your AV, or contact your AV vendor/reseller. IF you can't get/pay a AV Live cd, do the following. Prepare (clean install) a laptop/pc with the AV,antirootkit, antimalware of your choice and put the "infected" hard drive as an external (with a sata-ide to usb cable) or as a slave harddrive. I would choose the sata/ide to usb cable. Its cheap and fast. Scan again and again.
- Update the virus definitions (in memory or usb) and scan the whole system.
- Clean any infections.
- Scan again, the whole system. DON'T boot to normal OS yet. Check if you have still have infections.
- Do the same with any Live CD you have with Antirootkit or Antimalware capabilities. Some really bad malware/rootkits hide in the MBR and survive reboots or even after a "good" clean.
Boot your pc into SAFE MODE (if it's Windows) if you can't boot from a cd and repeat previous steps. Still a safe bet but you might not be able to get rid of some really bad malware/rootkits. A dead system is allways easier to clean.
- Reboot to your OS, only if you are pretty sure that u got no more infections. Don't connect to any network (internet or lab) yet
Stop USB infection
- Use Panda USB Vaccine. Or see the MS article (5th link). Vaccinate your pc AND all your usb. You will disable your Windows Autorun/Autoplay features. And your usb will get a autorun.inf file (it's blank, a dummy one), and even if you put it on an infected PC, you might get the virus (hidden exe,bat,scr..etc) BUT your usb will not AUTOMATICALLY infect other pcs, unless you run the exe's on purpose. The USB drive will lose the vaccination ONLY if you format it. Remember that.
- Make VISIBLE, your hidden files, AND your Protected/system files. Many viruses are marked as system files and get under the AV radar. Apply that to ALL folders.
- Use an AV that auto scan ANY usb device, Kaspersky and free Avira do exactly that. Maybe others as well.
- DON'T double click on the USB or CD-DVD icons from "My Computer". That way (the default Windows way), the OS see if the CD/DVD/USB has a autorun.inf file, and if they have it, it's executed and after that the contents are displayed. A more safe way is to Press winkey+E (Windows Explorer) and navigate to your drive from the left panel. That way you tell the OS to display just the contents. Even if your drive have an infected autorun.inf, it doesn't autorun.
- Update, update, update. Not only your Operating System but also your programs !!!!!!
Getting your files back, after been infected and deleted by your AV
- Use photorec or any other "Undelete" program you want/know/have. You will also recover viruses so be careful.
Get a USB with write protection. Cheap solution.
Use a Stand-alone laptop with 3 or more AV as a "Scan-USB machine". Use only one AV as a resident AV and the others as on-demand. Otherwise you might have problems. Connect it to the internet only to update the AV signatures. For nothing else. Anything that you want to put inside you lab will be scanned FIRST from that laptop with 3 AVs. Another cheap solution.
You might want to implement the previous idea to everything you download from the internet. Configure your lab so ANYTHING you download, goes to a temp folder, scanned from 3 AVs, one by one, and if it passes the check, then be available for you to get it. Our admin had it that way. I think it was configured from the ISA Server. I'm not sure.
Install and Endpoint protection system. GFI Endpoint Security and Symantec Endpoint Protection, provides protections from unauthorized usb drives.
Search for HBGary Inoculator. From their site: "It's an enterprise appliance designed to detect, remove and prevent Windows® host re-infection of known malware, without waiting for your antivirus vendor to provide a detection signature. With its breakthrough Digital Antibody technology , Inoculator provides a countermeasure against targeted cyber threats, without disruption to your enterprise." Haven't tried it.
I am curious to hear the progress/result from your lab.... :P