-: Once you've identified that there's a symptom of malware
that may be existing on your computer
what should you do about it?
Well, the first thing you should do is scan the computer
to see if there's actually malware on it.
In this case we have a virus that's been detected.
How are we going to clean out that system from this virus
or other types of malware?
Well, before we take any action to try to clean up the virus
we want to make sure we have a good backup
of our current system.
As we go through, we try to clean up the malware,
we may have to change file systems.
We may have to delete everything and start all over.
We may have to change different configurations.
And so making sure that we have a good backup
of all of our files is critically important.
The first thing we're going to do
is identify the symptoms of the malware infection.
What is your computer doing
that makes you think that it's been infected?
Have new files been created?
Is the computer acting slowly?
Do you have gibberish showing on your screen?
Whatever the things are, you need to notate that.
And because that will help you determine what type
of virus or malware has been infecting your machine.
Next, we're going to quarantine the infected systems.
Now what does that mean exactly?
It means that we want to prevent this system
from communicating with other systems
so that the malware from this system can't spread to others.
Most commonly, we do this by turning off the network card
or unplugging the network cable to remove your computer
from your production network.
The third step to removing malware
is to disable your system restore
if you're using a Windows machine.
The reason we want to do this is we want to make sure Windows
isn't continuing to take snapshots of our infected machine.
This makes a lot of sense if you think about it.
Let's say we go and we clean out this piece of malware
and a couple of months go by or even a year
and we have an issue with our system.
We decide to revert to a good backup.
And we end up choosing one of those snapshots that was taken
while the malware was enabled.
This is going to be a mistake that we did,
but by doing so, we're reintroducing
and reinfecting ourselves.
And for this reason, we want to go
and turn off our Windows Restore.
Also, we want to go back and delete any of the snapshots
that may have been taken
during the time the computer was infected.
The fourth step to removing malware
is to remediate the infected machine.
This includes updating our antivirus
and anti-malware software on the machine,
using its scanning capabilities, quarantining capabilities,
and removal techniques to our advantage.
Now, what are some of these techniques?
Well, this includes doing things like rebooting your machine
into safe mode and going into a pre-installation environment
and then running the scans from your anti-malware software.
Now, this is important because if you're using
a normal Windows machine, a lot of the files are in use
when you're normally booted up.
And so to remove that virus, you need to make sure
that that file isn't in use.
But when you reboot yourself into safe mode,
you're able to minimize the amount of files
that are in use and allows the anti-malware solution
to more effectively remove the malware much more cleanly.
Our fifth step is to schedule automatic updates and scans.
This will ensure that we've removed the malware
and we can prevent it from coming back.
The most common way of getting malware into your system
is because you don't have
an updated anti-malware solution on there.
By scheduling automatic scans and updates,
we're going to make sure that the engine
and the virus definitions
are always up-to-date in our anti-malware product.
And we're going to make sure we're doing a scan
at least on a weekly basis to keep malware off our system.
The sixth step is to re-enable our system restore.
And we want to create a new restore point
now that we have a clean system.
We're going to label this as a known good backup
because there's no malware in the system,
and we've already cleaned everything up.
This gives us our fresh new starting point.
So, if we have any issues in the coming weeks,
we can always roll back to today's date.
The seventh step and final step
is that we're going to provide end-user
security awareness training.
Yes, this is very important.
Because if the user is the one who clicked on a link
or downloaded a piece of software and got the virus,
we want to show them the proper things to do
so this doesn't happen again in the future.
One of the biggest problems we have
in our enterprise networks
is that our users do silly things.
And that is the source of most of our security problems.
So, making sure our users go
through good online security training
and learning the proper way to use their machine
is going to help us prevent a lot of issues in the future.
Now, one final note, if you have a boot sector virus,
you're going to have to reboot your computer
from an external device to scan it.
The reason for this is when you boot it up
from the internal hard drive, it's going to
read from the boot sector and load up the virus,
whether you're in safe mode or in normal mode.
But when you boot from a USB, a CD, a DVD,
or an external hard drive, you're going to be able
to scan the internal hard drive including that boot sector,
and that way, you can find that malicious file
and get it out of there.
Another technique or method that you can use
to remove malware from a drive is to physically remove
the hard drive from the victimized machine.
Connect it to a clean workstation as a secondary drive
and then scan it using that clean workstation.
Again, because it's being hooked up as an external drive,
the files aren't already in use,
and then malware can be more easily removed
and then replace that hard drive back
into the victimized system to go
through the rest of your restoration steps.