Best practices for handling computer viruses

Question

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.

In a small-to-medium business (heck, even large businesses like the New York Times), acquiring malware seems like an inevitability. Despite putting checks and balances in-place (updated workstations with security patches/java/flash, up-to-date anti-virus software, spam filters, etc.), viruses still penetrate through the cracks and some are able to execute.

My question is not so much about the prevention of viruses, but rather what you do with that workstation after it's been discovered that it has been compromised. Obviously we'd all feel more comfortable with the old NIFO stance, however many of us are strapped for resources and don't have time to always be re-imaging machines — especially if the bugs show only with "on-demand scans" and don't appear to have executed.

I'm curious as to what others in my situation are doing once a machine is found to be compromised. Is a "revert to old restore point and on-demand scan in safe mode" enough, or do you guys always re-image a machine?

Answer 1

Nuke it from orbit. The only way to be sure it is gone once it is compromised is to blow it away entirely. Restore checkpoints only help for configuration issues, a virus can alter the previous configurations or install itself in such a way it survives a restore. If it's just adware, then removal may be sufficient, but viruses can be very sneaky.

It might be possible to get rid of it completely, but it will take more time (days) than nuking and rebuilding in most cases, particularly if regular backups are kept.

Edit: As Oleg was kind enough to point out. If your re-imaging from a hidden partition on the computer, it is possible that the image could have also been infected. It's also possible that the BIOS (or other firmware in hardware) could have been infected in very rare cases, in which case you are looking at a major pita to get rid of it. Luckily 99.99%(my approximation) of the time, it isn't hardware resident yet.

Answer 2

Nuking is mandatory. That being said, I don't erase the old image; I keep the data files somewhere, to be resurrected after due inspection. For instance, I don't destroy mailboxes; I scan them for attached files which look like executable files, and, when found clean, I put them back on line.

For the base OS and all its binaries, cleansing flame is the rule. It is so much faster to just reinstall the machine anyway...

Answer 3

Monitoring to make sure the malware was completely removed takes more time, effort and skill than re-imaging or re-installing the machine.

Antivirus is mainly reactive by design and will detect initial infections. Malware will download new variants to stay ahead of detection so you can't know for sure that AV removed all bad code and repaired configuration changes.

In theory, rootkits can control everything you see (The Matrix style) so you can't be sure of anything while running the infected machine. I've seen rootkits that "hide" the malware traffic so it is not visible from the same host.

A solution is to run an offline diff and check for modified binaries and settings. You still have to manage regular snapshots similar to a backup. But then, why not re-image and restore backed up data?

Answer 4

It depends on the type of infection you are dealing with. If your bios or firmware get modified by a malicious program, reinstalling may not work. Though rare, it is possible.

In my experience, pursue proper handling of permissions by restricting most users to userspace, refusing usb drive mounting or at the very least, disabling autorun or execution of code (mount read only). Have secure binaries or sources of required applications such as found in a secured central repository, or converting critical machines and processes if possible to a more secure operating system, such as OpenBSD, which has a lot of security (better permission schemes, groups, more flexible logging schemes, etc) out of the box.

Important to note, is that any machine connected to a network will be at risk. Have regular backups of data, avoid insecure browser plugins such as flash, java and silverlight/moonlight wherever possible.

Train staff in proper processes. Don't trust users, but let them do their jobs.

If machines do get infected and you have to reinstall, at least have a PXE or network boot installation for reducing downtime.

Answer 5

As everyone else as said, nuke that thing to death. That way there is no chance for failure. I mean theoretically, a bootkit could survive a nuke, but I don't see it being very likely that a bootkit has you infected.

Only thing I want to state different is be careful storing any important data before the whipe. Upload online, and not by usb. Any half decent strain of malware will have a usb spreader, that will infect any portable drives you put into your computer. So it's not good if you nuke the computer, then end up reinstalling the virus by mistake. So for safety:

-Upload all important files online -Commence nuke -During the nuke, go through any important online services and change passwords. Just to be safe, if any data has been compromised. -Good to go

You could go through your system, and dig through the trenches for a week or two to find the malware and attempt to completely remove it .. or spend a day to whipe and reinstall.

Answer 6

Check what exactly you're dealing with. Most antiviruses give your name of a threat and you can check description of threat online. If you got simple JS/Flash based cookie stealer that exploits hole in browser version that was out of date year ago, then forcing user to reconfigure everything just for the sake of "cargo cult security" ritual is pure idiocity. Nuking is only really necessary for low amount of threats that exploit deeper levels of system.