Edit: Let's assume Windows 7 and potentially Windows Server 2003/2008.
IMHO, any machine that has malware should be reimaged/reformatted/OS reinstalled before it is deployed back into the environment. However, this isn't always practical. If the malware-type can be identified and potentially removed, sometimes the business dictates that a machine is remediated. So, my question assumes that management insists that a machine is remediated and has accepted the risk of doing so. Also, assume that all root cause analysis on the infection has already been completed. I would like to build a checklist of things to look at with the goal of reversing any changes malware has made to a system.
Edit: Due to the broad nature of this, perhaps those that are familiar with malware analysis can comment on the most common things they see malware change on a system that are related to maintaining persistence even if the malware is disabled/removed. (e.g., create an account or other backdoor that allows remote access to a system). Obviously, there are entire books and courses on this subject. This is not meant to be comprehensive. Rather, it is a checklist of common things to check/fix for a situation where reinstalling the OS is not an option and it is believed the malware has already been removed.
Here are a few examples:
*review all autostart locations and verify persistence mechanisms are removed *multiple virus/malware scans of the drive slaved to another system (using multiple tools) *all local/network account passwords changed *local accounts/groups reviewed for issues (e.g., new accounts) *etc/hosts file reviewed *sfc /scannow *review firewall configuration *review MBR *review and file/folders created/modified at the time of compromise. *review $MFT for timestomping (assumes NTFS)
While I agree a reimage is much simpler and a better solution, I thought it would be a good idea to develop a best practice for attempting to verify a machine has been remediated. Many of these steps also fall in the category of malware detection as well.
I reviewed the following related posts: