How do you decide enough is enough?

Hi All,
First post here,and I wanted to ask "At what stage do you
stop testing"?

I have just cleaned a winxp pc of various spyware threats.

First was update and run Macafee virus. 0 found.
Then same with AdawareSE. 27 malicious threats
plus 3 that needed reboot to fix.

Then run Ewido.3 found and removed.

Ditto MS antispyware.

Finally ran Spybot which found 94! still there including
various search/shopping trash.

So, when is enough enough! And why are so many
threats not found when you update to the latest
definitions of various programmes?

Just what is the final assurance that your PC is
clean? A re-format?

Ewido was disappointing,considering it's reviews.
I have it on my machine,but S&D picked up so
much that got through

My PC is totally clean,but I have about 8 different
test tools and don't surf porn,warez,file sharing etc

The problem comes when new users click for free
stuff etc and get infested.

Minutes to get in,hours to get out.

That's if you KNOW you have it all.

 

How many scanners are enough. Good question. Here is my list:

Resident scanners:
Ad-Aware SE Personal 1.06
A-squared scanner 1.6.1
Mischel TrojanHunter 4.2
Kephyr Bazooka 1.13.03
Trend Micro CWShredder Version 2.19
F-Secure Blacklight Rootkit Elimination 2.2.1015
Sentinel 2.1.0
Sysinternals RootkitRevealer 1.6
HijackThis 1.99.1
DllCompare
Kaspersky AV 5.0
UnhackMe 3.0
SpyBot Search & Destroy

Online Scanners:
CounterSpy spyware scan
Ewido online scanner beta & Ewido Micro
Help2Go Detective, HijackThis log file analysis (HijackThis Analyzers)
Jotti's malware scan
McAfee online virus scan
Webroot Spy Audit
X-Clean Micro (Facetime.com) spyware scanning

I consider my primary to be Kaspersky which I run at least weekly. I then run various scanners on my list now and then just to be sure. I run a fire wall, HIPs and other up front protection. That is the main defense.

I would try HijackThis, maybe an online scanner and perhaps a rootkit scanner. With what you already ran you are most likely clean. Are there any symptoms on your machine that make you think you have a problem?

 

for removing malware from others' computers i would just scan with ewido, but for me, i also use avast or nod32 and Spy Sweeper.

 

For me spybot is kind of overrated. It started to pick up a few of SpywareBlaster's entries the other day. :T

 

With blacklist scanners, it's never enough !!!
Not blacklisted = no protection, unless heuristics catch it, but that's no guarantee.
The scanner message "Congratulations !!! No threats found." might be a comfort for you and gives you at least the feeling, you are safe. Psychology is very important in security.

 

When I am dealing with a machine that is that infested, I don't take chances, just format. When there's that much stuff, it's going to be very difficult to ensure that it's all gone. Then you take a good long look at how to prevent it from happening again

 

I concur. In my newbie time Spybot found more than 200 threats, which was my very first scanner after NAV.
I re-installed my harddisk from scratch.

 

Even this might not even be enough. Here is one of the best threads I've ever read on the subject of 'Hardware Viruses' (Well, it's entertaining anyway) http://www.dslreports.com/forum/remark,13853178?hilite=hardware viruses

 

It's likely that spybot picked up things like cookies, that Ewido did not.

Personally, if I'm cleaning a computer, I would use the following free stuff :

<clean out your cache's & temporary folders first>
<disable system restore>

<Scan these in safemode>
Ewido free
Bitdefender free
MSAS
Ad-Aware SE
CWShredder
Aboutbuster

<run online scanners>

Kaspersky online scan
Webroot spysweeper online scan

Don't know that that's perfect...It should get almost everything...but I suppose there are no absolute guarantees.