Virus Troubles.

This originally was a comment in response to Arvind's latest post, but it become too long.

Viruses just really suck.

I've had my (HUGE) share of troubles with them, and I'm pretty sure I got that same virus that at first redirects all google searches. I forgot the name but was it the google analytics virus? The name comes from the url that appears at the bottom of the browser during the redirects. At first, this seemed pretty harmless, right? But that was the god damn hardest virus I've ever had to clean.

Details below for future reference and some potentially helpful info, and if this is not actually the virus Arvind had, it'll just be a petty rant on a tasteless topic:

Why that virus was AWFUL
(1) Some common anti-spyware couldn't detect it (Windows Defender, AVG)
(2) Some common anti-spyware finds malicious files, deletes them, but problem persists, and the anti-spyware never picks up anything after the first scan (Symantec).
(3) The best free anti-spyware by general online consensus (Malwarebytes Anti-Malware) would find these files along with one file that it could not delete. You realize after several scans that this file would not go away, but then the virus kicks in and shuts down any more scan attempts.
(4) The virus prevents you from updating ANY anti-spyware program. When I discovered that the virus could potentially be monitoring my network connection and sending/receiving info, I freaked out big time. I immediately switched off the external wireless switch and pulled the cable.

So my laptop, without internet connection, was practically incapacitated. How on earth is one suppose to clean a virus when none of the anti-spywares work and one can't download/research new fixes? Well luckily, I had a second laptop (take that virus!).

After more hours of searching with not much success on an easy fix, I conceded that I had to use the LAST RESORT for virus cleaning short of a complete wipe and re-install: combofix. I don't know how many of you actually have heard of this program, but let me warn you it is not something to be messed with. Heck, it can't even qualify as an anti-spyware program because it is so incredibly powerful, and can be just as harmful to your computer as the most potent of viruses. I'm certainly not an expert, but from what I've learned, combofix is basically the purest brute force method to virus deletion there is. Here's the gist of it: you allow combofix access to everything on your computer; BIOS, root files, system restore files, OS, everything.....You even have to disable every anti-spyware program on the computer (God forbid what would happen if any of your anti-spyware programs realize what combofix is doing, and what combofix would do in response!). There's the (not unlikely) possibility of it deleting any of those files, but you pray it finds the right malicious files to delete.

Not very pretty, hence why it's the last resort for anyone not trained in using it. Plus it's pretty much a one shot deal: if it works, your computer's home free; if it fails, your computer is practically beyond hope and you lose everything. What about backup? Well the problem is if you're dealing with a virus so nasty that you're resorting to combofix, you probably don't want to connect anything valuable to those USB ports.

Anyways, my method was downloading combofix onto my clean laptop, transfering it to a flash drive I didn't care about, and then running it on the infected laptop. The result? SUCCESS!!! And a fury of virus scan safety checks followed.


Operation Type: Spyware Counterintelligence
Operation Duration: 24+ hours over the span of 3 days
Operation Success

Afterthoughts: Never forgive, never forget.