The Basics of Manual Malware Identification and Removal

Exactly! From what I've been told it is frequently possible to bypass many Security Solutions with malware (like knives through soft butter- not that I would personally know, of course). So it is without doubt useful to have knowledge of some fast and easy checks on the efficacy of the currently used Security product.

 

Which is why Comodo firewall is on my laptop. It's been on my computers for years.

 

You did not read the word "before"? Do you interpret the word "before" as "may be after"?

No it is not! That's just silly.

A Stop sign means "stop" - a complete stop! In spite of what some drivers think, that cannot be interpreted as "go".

Same is true in "technical" writing too - which you would have learned if you had taken any courses beyond your high school (GCE 'O' level) English class, or if you had taken any entry-level technical writing courses. That's not meant as a personal criticism, just a practical fact.

"Technical" papers by their very nature are not meant to be open to personal interpretations. They are meant to be technically accurate. If the author says a 1/4 inch hole is to be drilled 3.75 inches from the left edge and 4.0 inches down from the top edge, we don't get to interpret that as an 1/8 inch hole approximately 3 inches from the top and left edges.

"Before" means "before" - as in "ahead of" or "previous to" the installation of security software. Not "may be after". And that's whether in a technical paper, or a work of fiction.

 

I used to think like you; I studied Elec Eng (BEng(Hons)) many, many years ago and spent many years in the tech sector. Then I did a qualitative PhD in a business subject. I had planned to do a quantitative study as I've done engineering maths and a bit of stats will be a breeze, but I was so enamoured by the lecturers' views on bias and interpretation, I switched. It always worth being reflexive and questioning your own bias, don't you think?

I will try to interpret your understanding of the article. You are focusing on the first paragraph, which is completely negated by the second one in my opinion. The author could lose the first para completely and not detract from the message of using autoruns and processexplorer, which is what I would have done as I don't work for a security company. However, as they are a security company it would bring the customer to question the efficacy of their product (unless they slagged off competitor products in the article) - we all know that all security products are 100% as far as the security marketing guy/gal goes - so in the first para they talk about malware on a PC before it has any security installed. Whether there was security installed or not the focus is on its removal, which, I believe, is what the author wants the reader to focus on. But this is my interpretation of the article, and what you are focusing on. You telling me and others we are wrong will not change our interpretation because we are ignoring the first para and looking at the article in it's entirety. Ask anybody to give you a sentence to sum up the article: removing malware using autoruns and processexplorer, is my take.

I notice your tone has changed. Suffice to say, never make assumptions about somebody on a forum. You never know what experience/education they have. I always assume that people on security forums are bright as it's such a turgid subject. I would be too frightened to be condescending, and I was always told by my mum to be civil as it costs me nothing.

 

I like that!

Fact is, with all the gazillion programs being offered here at Wilders, just pick a few that appeal to you. Avoid careless, stupid surfing, and you're good to go. And have a backup/recovery strategy.
Acadia

 

You can follow the link in my sig to see if I might have some experience with technical writing.

Because you are wrong! "Before" means "before", not "after" and not "may be after". Sticking your head in the sand does not change that facts.

You choosing to ignore the author's first paragraph so you can rationalize your incorrect interpretation/definition of the word "before" is just silly. You imply you are a PhD candidate - that's great! But then you should know that writing papers involves creating an introduction, body and then summary/conclusion. And you would know the introduction is the first paragraph(s) and explains the main point of the paper.

The author's first paragraph asks, "what do you do if your machine gets infected before you’re able to install security programs?" The fact the author then goes on to talk about getting infected afterwards just proves the point I have been making all along - the article is misleading!

You can take away from the article what you want - and removing malware using autoruns and process explorer is fine. No argument from me on that. That was NOT the point for me saying the article was misleading.

 

@Bill_Bright
I don't know what the big deal is if you get infected before or after you install security solution and why an article would be misleading.
Last week I installed new Windows 7 system for my friend. I had to connect it to internet in order to update it (or download AV solution if I have chosen to do it before). System could get infected during this time and I could use similar tools to try to clean it up (although I would probably just reinstalled it if that happened). So IMO situation is definitely possible - no probable, but still possible.
Even if you don't like an article, or see it as missleading, some members don't feel like that. So we can leave it at that, without trying to persuade each other who "got it right".

 

I would have been perfectly fine with "leaving it at that" after my first post. But note you in Post #5 and others following took exception to my opinion, and tried to convince me that I was wrong. So it works both ways.

And again, all I said was the article was misleading. I did not say it was wrong or inaccurate, or without any use.

But I do agree and at this point, we all should just leave it at that.

 

Great! Thank you. We each saw something different, and there's nothing wrong with that.

 

Exactly, no one can deny that. As far as i know, not all of the Windows' users are on Win8/10. So the article isn't misleading.

 

How to Perform Manual PUP Removal

https://blog.emsisoft.com/en/31451/how-to-perform-manual-pup-removal/

 

Here we go again.

Actually, the article is pretty good. My comment is it should never be needed if your security solution is does its job by preventing their installation in the first place.

 

Yes, but on the whole, security software does a terrible job of detecting PUPs. A notable exception is Dr Web, which detects around 3,000 different PUPs. However, while it can detect the installers, I have no idea how well it does at removing them, once they are installed, as I don't use Dr Web.

 

How to Perform Manual Ransomware Removal

https://blog.emsisoft.com/en/31793/how-to-perform-manual-ransomware-removal/

 

Somehow I found this interesting.

 

How to remove fileless malware

https://blog.emsisoft.com/en/32034/how-to-remove-fileless-malware/

 

I keep a dedicated system with that same security solution on it courtesy @cruelsister's applied rules and the sandbox containment is been magnificent in so many tests I thrown at it.

Which is just peachy for a local user's machine. The question that rises up for me is to how well it would contain/protect the same on industry/business office dependencies where one single stitch of malicious/targeted compromised data could mean a large financial loss.

Just hypothetical of course, but it's still an interesting thought.

 

FireEye has an excellent "deep dive" article on WMI attacks here: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf.

Note the limitations of Autoruns: