Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I realize this question may be quite broad (and hopefully not a violation of the FAQs), but I'm interested in hearing how many of you handle a computer infected with Malware.

In a small-to-medium business (heck, even large businesses like the New York Times), acquiring malware seems like an inevitability. Despite putting checks and balances in-place (updated workstations with security patches/java/flash, up-to-date anti-virus software, spam filters, etc.), viruses still penetrate through the cracks and some are able to execute.

My question is not so much about the prevention of viruses, but rather what you do with that workstation after it's been discovered that it has been compromised. Obviously we'd all feel more comfortable with the old NIFO stance, however many of us are strapped for resources and don't have time to always be re-imaging machines — especially if the bugs show only with "on-demand scans" and don't appear to have executed.

I'm curious as to what others in my situation are doing once a machine is found to be compromised. Is a "revert to old restore point and on-demand scan in safe mode" enough, or do you guys always re-image a machine?

share|improve this question
3  
I can tell you from personal experience (we were down for 3 weeks in December) Nuking is the only thing you can do. I'm not our IT person I'm a programmer, but I recommended that we Nuke, instead the president (its a small company only 30ish employees) went with our IT's plan, which was to try and contain, and remove. Well he finally (after the virus showed up on the network for the third time, and killed our server) went with Nuking. It took 2 days and then we were back up, with out any issues since then. Your ONLY option is nuking. –  ryan Feb 1 '13 at 21:36
2  
Not only is nuking safer, in most cases it's a faster solution than troubleshooting a virus. –  Austin Feb 1 '13 at 21:42
    
Bullshit. How running one scan/remove pass that is enough for most simple viruses is any faster than reimaging and having to reconfigure entire workflow? –  Oleg V. Volkov Feb 2 '13 at 1:00
    
@ryan, if your SERVER can be destroyed from LAN, then viruses and nuking of WORKSTATION is the least of your problems. –  Oleg V. Volkov Feb 2 '13 at 1:05
    
to discover them easier run full scans regularly (as in daily) on every computer no exceptions –  ratchet freak Feb 2 '13 at 14:19
show 6 more comments

6 Answers

up vote 29 down vote accepted

Nuke it from orbit. The only way to be sure it is gone once it is compromised is to blow it away entirely. Restore checkpoints only help for configuration issues, a virus can alter the previous configurations or install itself in such a way it survives a restore. If it's just adware, then removal may be sufficient, but viruses can be very sneaky.

It might be possible to get rid of it completely, but it will take more time (days) than nuking and rebuilding in most cases, particularly if regular backups are kept.

Edit: As Oleg was kind enough to point out. If your re-imaging from a hidden partition on the computer, it is possible that the image could have also been infected. It's also possible that the BIOS (or other firmware in hardware) could have been infected in very rare cases, in which case you are looking at a major pita to get rid of it. Luckily 99.99%(my approximation) of the time, it isn't hardware resident yet.

share|improve this answer
    
No, it is not a way to be sure. FWIW it could already be on your image or boot system out of reach. –  Oleg V. Volkov Mar 6 '13 at 13:16
    
@OlegV.Volkov Getting on the image would be hard if it is the installation media (rather than one of those stupid manufacturers that ONLY gives you a recovery partition). The BIOS is a valid point, though those are more rare and if you have one, the answer is going to be far more of a pain than a simple Q/A site is going to be able to explain in a universal sense. But it is still a valid point. –  AJ Henderson Mar 6 '13 at 13:59
    
@AJHenderson "rebuilding in most cases, particularly if regular backups are kept" - always was wondering about that - isn't this, just about, as much of the reinfection vector as trying to clean it out, since virus may've infected the data files and is thus in the backup itself? I suppose if detection of infection is near-immediate, then chances are small; but what are the chances of near-immediate detection? Wouldn't restoring the backups carry relatively similar reinfection risk as cleaning out the virus? –  LB2 Mar 31 at 13:46
    
@LB2 - this is why backups shouldn't be kept attached to the computer. A backup should be on an external drive. That said, it is far less likely that a particular virus knows how to hide in a particular type of backup file than it is that it knows some general mechanism of hiding on a complex system that you can't possibly hope to find it in. –  AJ Henderson Mar 31 at 13:55
    
@AJHenderson Right, but that's not quite what I meant. There are plenty of viruses that infect .doc files (or picture files, or ...). User acquires infected document and saves to their documents/picture/etc folder. Backup runs and backs up the infected file(s). Later infection is detected (wherever, not necessarily in original file), machine de-orbited, burned, and phoenix-reborn. Backup restored - along with original virus inside that document (or picture, or ...). Virus need not know how to find backups to infect - it simply piggies-back onto backup stream unknowingly to itself. –  LB2 Mar 31 at 14:29
show 4 more comments

Nuking is mandatory. That being said, I don't erase the old image; I keep the data files somewhere, to be resurrected after due inspection. For instance, I don't destroy mailboxes; I scan them for attached files which look like executable files, and, when found clean, I put them back on line.

For the base OS and all its binaries, cleansing flame is the rule. It is so much faster to just reinstall the machine anyway...

share|improve this answer
add comment

Monitoring to make sure the malware was completely removed takes more time, effort and skill than re-imaging or re-installing the machine.

Antivirus is mainly reactive by design and will detect initial infections. Malware will download new variants to stay ahead of detection so you can't know for sure that AV removed all bad code and repaired configuration changes.

In theory, rootkits can control everything you see (The Matrix style) so you can't be sure of anything while running the infected machine. I've seen rootkits that "hide" the malware traffic so it is not visible from the same host.

A solution is to run an offline diff and check for modified binaries and settings. You still have to manage regular snapshots similar to a backup. But then, why not re-image and restore backed up data?

share|improve this answer
add comment

It depends on the type of infection you are dealing with. If your bios or firmware get modified by a malicious program, reinstalling may not work. Though rare, it is possible.

In my experience, pursue proper handling of permissions by restricting most users to userspace, refusing usb drive mounting or at the very least, disabling autorun or execution of code (mount read only). Have secure binaries or sources of required applications such as found in a secured central repository, or converting critical machines and processes if possible to a more secure operating system, such as OpenBSD, which has a lot of security (better permission schemes, groups, more flexible logging schemes, etc) out of the box.

Important to note, is that any machine connected to a network will be at risk. Have regular backups of data, avoid insecure browser plugins such as flash, java and silverlight/moonlight wherever possible.

Train staff in proper processes. Don't trust users, but let them do their jobs.

If machines do get infected and you have to reinstall, at least have a PXE or network boot installation for reducing downtime.

share|improve this answer
add comment

As everyone else as said, nuke that thing to death. That way there is no chance for failure. I mean theoretically, a bootkit could survive a nuke, but I don't see it being very likely that a bootkit has you infected.

Only thing I want to state different is be careful storing any important data before the whipe. Upload online, and not by usb. Any half decent strain of malware will have a usb spreader, that will infect any portable drives you put into your computer. So it's not good if you nuke the computer, then end up reinstalling the virus by mistake. So for safety:

-Upload all important files online -Commence nuke -During the nuke, go through any important online services and change passwords. Just to be safe, if any data has been compromised. -Good to go

You could go through your system, and dig through the trenches for a week or two to find the malware and attempt to completely remove it .. or spend a day to whipe and reinstall.

share|improve this answer
add comment

Check what exactly you're dealing with. Most antiviruses give your name of a threat and you can check description of threat online. If you got simple JS/Flash based cookie stealer that exploits hole in browser version that was out of date year ago, then forcing user to reconfigure everything just for the sake of "cargo cult security" ritual is pure idiocity. Nuking is only really necessary for low amount of threats that exploit deeper levels of system.

share|improve this answer
    
So how can you be SURE that you only have to deal with "common" threats? -1. –  Terry Chia Feb 2 '13 at 7:45
    
@TerryChia, check the last sentence. Nuking is an option, not something you do every time. –  Oleg V. Volkov Feb 2 '13 at 9:52
1  
@OlegV.Volkov I think what TerryChia is talking about how can you be sure that the threats that are at your workstation are only infected with "non-crucial" malware? Malware A may download Virus B, Trojan C, Backdoor D from a remote site to the workstation to cause more infection(steal more data) and impact(chaining effect). –  wcypierre Feb 2 '13 at 11:10
    
@wcypierre, this would again be described in malware description. However if you wish to argue about "yet unknown effects", how can YOU be sure that RIGHT NOW your PC is not infected with super-stealthy malware controlling all your online life and that you not need to re-image RIGHT NOW? How can you be sure that it didn't stealth-copy itself to your image either? Can we please talk about practice and not rituals with imaginary begins (does that remind you of anything)? –  Oleg V. Volkov Feb 4 '13 at 10:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.