Commercial Virus Detection/Remover

[DhCoder]

Friend of mine is starting a business and was asking what most computer repair shops use as a virus remover... I've always used an assortment of programs and then usually end up having to google how to remove after I figure out which virus the pc is infected with.

However, it got me thinking. What are these medium - large sized businesses using for virus removal. I imagine the larger businesses are either partnered with one of the main virus removers apps or they use proprietary software.

Does anyone know of decent software for detection/removal of virus that has commercial license available?

[PhilliePhan]

However, it got me thinking. What are these medium - large sized businesses using for virus removal. I imagine the larger businesses are either partnered with one of the main virus removers apps or they use proprietary software.
Does anyone know of decent software for detection/removal of virus that has commercial license available?

On a business scale, it is really not practical to try to remove malware. Today's malware can really "dig in" with rootkits and the like.

Reformat and reinstall of OS is best.

My ideal solution would be backed up / cloned hard drives. Or use a disk image solution such as ACRONIS and save yourself the hassle and headache.....

If you are still set on trying to remove malware, there really is no one single solution.
MalwareBytes' Anti-Malware is good for a lot of active infections. But, additional tools such as combofix / OTL / GMER are often needed to clean up tough infections.
If you are not comfortable in the usage of those, then again I recommend and Acronis type solution.

Cheers :)
PP

[JHunn]

Phillie,

If a computer is infected with a virus, would it not be useless to use Acronis to back it up? You would be copying the virus along with it.

[omol]

The best way is not to get one in the first place by having decent anti-virus and firewall configuration.

I think what Phillie was sugesting is take an image of your computer before you get infected, and if / when you do roll back to that image.

If you do however get infected the only way to be sure is to use something like hijack this and manually removing every file belonging to the rouge software.

Quickest way: Take an image of the computer, and then backup all the time and if infected roll back.

If you did not backup, hijack this and hours of tedious searching.

[JHunn]

In a business environment, where you are going to a client's house to repair a computer problem, it would not be practical to back up their system, nor would it help if they were already infected. I think what DHCoder is looking for is a software app that computer repair businesses use for client support and computer repair.

[omol]

Its a back to base job and lots of coffee then.

A few aproaches from that point.

1) Backup all work from the computer, reinstall the os and scan the media you used to copy files from the the computer to make sure thats not infected before replacing the files on the fresh install.

2) Manually remove or traces of the infection, no automated way can guarentee the complete removal of viruses due to their nature. Typically never called the same and never carry the same signiture between all compnents.

Anti-virus products identify viruses via a common denominator, most use a signiture commonly being the memory operations that the virus uses. An anti-virus program will cross refrence this running signiture with ones in its database, if they match your infected.

This method works only if the signiture is in its database so the virus has first got to be discoved by the anti-virus manufacturer. Because of this, you can never be 100% sure that something automated has fully disposed of the infection as virus writers are always updating and modifying there viruses. If this virus calls back to base it can update its self as soon as discovered.

Just changing a line of code will completly alter the signiture of a program.

[JHunn]

OK...so it sounds like the best way to be sure the clients computer is cleaned of a malicious virus is to reformat the computer. I assume copying documents and whatnot would be a safe bet? Do you think that is the approach commonly used by PC repair technicians?

[PhilliePhan]

Phillie,

If a computer is infected with a virus, would it not be useless to use Acronis to back it up? You would be copying the virus along with it.

As Omol noted, I read the original poster's question to be " What would be the best Anti-malware solution for a business." And I stand by my answer.

If the poster's friend were starting a Malware Removal Business, then my answer would be that he'd need a familiarity with ALL the tools available to him.
Again, MBAM and the like / Combofix / OTL / various ARK tools such as GMER.

-- Also, if you were to go to a client's house, bear in mind that some of these scans can take hours and you'd need to run 2-3 different tools to start. Not too practical - better to have the client run the scans, I would think...

Also, I would still say that the best solution to today's malware (which often has rootkit components) is to wipe the HD and reinstall the OS. Of course, this is not often a practical solution for numerous reasons - Important data not backed up regularly / no viable copy of OS for reinstall / etc . . .

As for your question about what repair technicians would do - that all varies. A shop specializing in malware removal would use all of the tools I mentioned. Still, I doubt they could guarantee their work - again, rootkits and all.... Can never "trust" a cleaned system after a rootkit. I am not sure how many of the bigger retailers would offer malware removal as opposed to wiping a drive - that might be interesting to find out.... Certainly wouldn't be cheap.

But, yeah - if a private user backs up important stuff regularly, go with reinstall...

Cheers :)
PP