Malware infection question


Recommended Posts

Usually when I have somebody come up to me with a computer that has Malware on it, I simply re install everything for them. Say what you want abotu it, but it is much faster to re-install than spend potentially days fixing the computer and making sure it is right before they go back to their banking.

So my question is this, I usually do a format, and re-install. Will a Windows 8 Clean Install Upgrade get rid of infections? I only ask because it still does make a Windows.Old folder if I remember. Couldn't the malware be in there when it is all done?

Lastly, has there been any word as to the $40 Windows 8 upgrade and installing it on a fresh drive? When I installed it, I needed Windows 7 fully installed before in order to get 8 to activate.

Link to comment
https://www.neowin.net/forum/topic/1120900-malware-infection-question/
Share on other sites

You should be able to format the HDD with the upgrade media, yes. At least I could with mine...

Ah I gotcha. So I think what I am understanding right is that I DO need to have some previous Windows version installed, but when I boot with the Windows 8 media, I can format it there just like Windows 7? That is probably why it did not work for me, nothing was on the drive when I tried.

3 hours, if it takes longer than 3 hours you are doing it wrong or they have a million files or so or a computer built in 1990.

I spend a few hours cleaning it, if it comes back within a week, which rarely does, I wipe and rebuild. You need new techniques.

On to your question, if you don't delete the partition and reformat the infection can still be in the boot sector. In the past, when doing a clean install from a upgrade disk you would just need to put in your old os media (xp, vista, etc).

Ah I gotcha. So I think what I am understanding right is that I DO need to have some previous Windows version installed, but when I boot with the Windows 8 media, I can format it there just like Windows 7? That is probably why it did not work for me, nothing was on the drive when I tried.

I also have 3 HDD's in my machine, which could have triggered the option to pop up. :p

3 hours, if it takes longer than 3 hours you are doing it wrong or they have a million files or so or a computer built in 1990.

I spend a few hours cleaning it, if it comes back within a week, which rarely does, I wipe and rebuild. You need new techniques. If you don't format, the infection can still be in the boot sector.

I seem to notice more and more that people's solution to a computer that doesn't work or is infected seems to be "step 1: format the machine." It's bizarre, for me a format has always been the final option, not the first. I would have lots of unhappy customers if I kept taking their laptop away and wiping it. :laugh:

I seem to notice more and more that people's solution to a computer that doesn't work or is infected seems to be "step 1: format the machine." It's bizarre, for me a format has always been the final option, not the first. I would have lots of unhappy customers if I kept taking their laptop away and wiping it. :laugh:

No one would trust me to do squat and word of mouth would be nil. Have to keep people happy, have to be fast, and have to keep data integrity. They want their computer back in a working state with all of their apps and files in tact.

I seem to notice more and more that people's solution to a computer that doesn't work or is infected seems to be "step 1: format the machine." It's bizarre, for me a format has always been the final option, not the first. I would have lots of unhappy customers if I kept taking their laptop away and wiping it. :laugh:

Format and reinstall is the only way to be 100% sure the malware is gone. I swear by this and its always my first option. Also you will have less repeats when this happens. Customers are alot careful due to the format and reinstall.
Format and reinstall is the only way to be 100% sure the malware is gone. I swear by this and its always my first option. Also you will have less repeats when this happens. Customers are alot careful due to the format and reinstall.

Sorry, I disagree. As sc302 said, all wiping their machine will do is send them to someone else next time who will attempt to preserve their data and settings. If someone on my team suggested formatting a machine as the first step, I'd have them removed from my team.

See we like our customers and like referrals. Referrals is free money. I spent 0 advertising dollars to get them in my door. I formatted once and cost a client and a minimum of 10 of their friends. I explained what was needed and she was not happy then when she picked up her computer she wasn't happy that I didn't have everything back to the way it was when she gave it to me. To get her out the door I had to eat it. Never has it happened again. Most people appreciate the effort and understand that if it needs to come back within a week that they should have a backup performed (I charge extra for the backup) but will wipe and rebuild their computer with any software they provide at no additional cost.

Again, that doesn't happen often. Once last year was the last I can remember.

Sorry, I disagree. As sc302 said, all wiping their machine will do is send them to someone else next time who will attempt to preserve their data and settings. If someone on my team suggested formatting a machine as the first step, I'd have them removed from my team.

I'm with you on this one, I used to just wipe and reinstall, but once I was trained up in a repair shop on how to remove malware thoroughly, formatting is only the very last option if all else fails.

I became pretty good at killing malware that more often than not, once I had done all my manual steps, scanners such as malwarebytes wouldn't find any leftovers for things like Antivirus 2010 fake AVs etc

I'm on both sides of this

1) If I was infected with malware (which I have never been) I would restore from a good image. after the malware was removed I would not use the installation in its current state. I would never again trust it.

2) None of us can be 100% sure we got everything it's impossible. Having said that when i'm done I am pretty confident the infection is gone. Rarely do I reformat and very rarely do I get any systems immediately back.

3) 3 hours can be about right. Hell a full scan with malwarebytes is usually 40 mins. I also do an external scan with kaspersky rescue from outside of windows. That can be another 40 mins or longer. I usually remove all temp and internet temp files (usually with ccleaner) to make the scans go as fast as possible.

4) If I had to format and reinstall I don't see my customers saying bad things about. It's not they would loose all their data.

3) 3 hours can be about right. Hell a full scan with malwarebytes is usually 40 mins. I also do an external scan with kaspersky rescue from outside of windows. That can be another 40 mins or longer. I usually remove all temp and internet temp files to make the scans go as fast as possible.

I always run CCleaner before Malwarebytes, works a treat to get all the junk cleared out before you scan for infection. Those two go together like peanut butter and jelly ;)

I always run CCleaner before Malwarebytes, works a treat to get all the junk cleared out before you scan for infection. Those two go together like peanut butter and jelly ;)

Correct, if you don't remove those internet temp files first 1 scan can EASILY! TAKE 2 hour - 3 hours. Yesterday I removed someones internet temp files, they had over 100,000 Internet temp files.

Correct, if you don't remove those internet temp files first 1 scan can EASILY! TAKE 2 hour - 3 hours. Yesterday I removed someones internet temp files, they had over 100,000 Internet temp files.

I once saw it remove over 15GB of temp files. I was floored...

I once saw it remove over 15GB of temp files. I was floored...

I sometimes use ccleaner, but sometimes I remove the internet temp files by hand and then rerun ccleaner for the rest of the files. ccleaner takes FOREVER to remove what takes far less time doing it by hand. As far as the reinstalls go, before I format I also backup their software registry Hive. I then run that through a product key finder and it extracts a lot of their product keys which allows me to reinstall some of their stuff for them, like office, norton and such.

I'm on both sides of this

1) If I was infected with malware (which I have never been) I would restore from a good image. after the malware was removed I would not use the installation in its current state. I would never again trust it.

2) None of us can be 100% sure we got everything it's impossible. Having said that when i'm done I am pretty confident the infection is gone. Rarely do I reformat and very rarely do I get any systems immediately back.

3) 3 hours can be about right. Hell a full scan with malwarebytes is usually 40 mins. I also do an external scan with kaspersky rescue from outside of windows. That can be another 40 mins or longer. I usually remove all temp and internet temp files (usually with ccleaner) to make the scans go as fast as possible.

4) If I had to format and reinstall I don't see my customers saying bad things about. It's not they would loose all their data.

Just to put something out there.

If you actually know what you are doing, then yes you can be 100% certain it is gone. If you send a customer a machine where you are only pretty certain it is gone, then that's really bad.

That is just inviting all sorts of headaches, especially if you didn't get it and they have their identity stolen.

If you cannot take the time to be certain you have eliminated the threat then send them to someone else or close shop.

Man, I really am getting more like Ramsay as time goes on...

Just to put something out there.

If you actually know what you are doing, then yes you can be 100% certain it is gone. If you send a customer a machine where you are only pretty certain it is gone, then that's really bad.

That is just inviting all sorts of headaches, especially if you didn't get it and they have their identity stolen.

If you cannot take the time to be certain you have eliminated the threat then send them to someone else or close shop.

Man, I really am getting more like Ramsay as time goes on...

If you want to go through every registry key and reverse engineer every file on the hard drive be my guest. What I'm saying is using the tools that I use, they tell me the system is clean. The issue they came in with is no longer there. I inspect the system and known malware locations, and running processes, host files, .... nobody can be 100% sure.

The last scan of many I do, is an external system scan with a kaspersky rescue disc, just to make sure I do the best I can to find infections that are trying to hide from the running OS.

I never had an issue with a customer being mad because of a format and reinstall. I have had issues where one of our other technicians tried to clean a system and return it to a customer only to have them come back again. I would sooner say in the position I am in I would get more angry people with the removal than I would the clean install. If the customer has data they must keep I boot them to something where they can back up the files to an external they provide. Once that is done then I blast away the system. Either way the risk of ID theft and such is too great to let the customer just leave with a simple removal.

If you want to go through every registry key and reverse engineer every file on the hard drive be my guest. What I'm saying is using the tools that I use, they tell me the system is clean. The issue they came in with is no longer there. I inspect the system and known malware locations, and running processes, host files, .... nobody can be 100% sure.

Yes exactly, if I tell my clients that do their banking and sensitive information that I could spend 3 or more hours fixing it, or spend the same amount of time re-installing. Most of them prefer re-installing.

It is much faster for me to install fresh and install their programs, than it is to try to mess with it. This is why I format, not because I am too stupid to clean it. But when people bank and have their tax stuff on there, you better be damn sure they prefer to wipe it.

I have my methods, you have yours. This post was not to get on me for my format choice. In my experience, it is much faster, and after I do a format I make a disk image and give it to them if they need it.

If you want to go through every registry key and reverse engineer every file on the hard drive be my guest. What I'm saying is using the tools that I use, they tell me the system is clean. The issue they came in with is no longer there. I inspect the system and known malware locations, and running processes, host files, .... nobody can be 100% sure.

The last scan of many I do, is an external system scan with a kaspersky rescue disc, just to make sure I do the best I can to find infections that are trying to hide from the running OS.

Doing that is not necessary to ensure the system is clean.

You can be certain and if you're not confident in your work being 100% accurate it has no business going back to a customer.

Going back to the Ramsay point. If you work in a restaurant are going to serve food you think isn't spoiled or food that you know isn't spoiled?

If it is the former the then I don't want you in my kitchen. :p

If you want to go through every registry key and reverse engineer every file on the hard drive be my guest. What I'm saying is using the tools that I use, they tell me the system is clean. The issue they came in with is no longer there. I inspect the system and known malware locations, and running processes, host files, .... no body can be 100% sure.

I so agree...one has to remember also you can not spent many hours or even days on a machine if you are in business , you are paid for volume of machines you put thru and your roi (return on investment) diminishes each hour you work on a machine. For the sake of discussion let's say you charge $200 (or something eqivilent in your currency) to fix it, 4 hours to reload it $50 an hour, 8 hours to find and kill malware $25 an hour and you have worked twice as hard

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • A 13 billion year old secret about our Universe's origin was revealed by Sayan Sen Image by Pascal Küffer via Pexels Researchers at the Max-Planck-Institut für Kernphysik (MPIK) in Heidelberg had recreated a key chemical reaction from the early universe, producing results that could change scientists' understanding of how the first stars formed. The study focused on the helium hydride ion (HeH⁺), which is widely regarded as the first molecule to form in the universe. Scientists believe HeH⁺ appeared around 380,000 years after the Big Bang, when the universe had cooled enough for electrons and atomic nuclei to combine into neutral atoms in a period known as recombination. This marked the beginning of chemistry in the cosmos. Immediately after the Big Bang about 13.8 billion years ago, the universe was extremely hot and dense. As it expanded and cooled, hydrogen and helium became the dominant elements. Once neutral helium atoms formed, they could react with ionised hydrogen nuclei, or protons, to create helium hydride ions. Although simple in structure, HeH⁺ played an important role in the young universe. It was the first step in a chain of reactions that eventually produced molecular hydrogen (H₂), a molecule made up of two hydrogen atoms and now the most abundant molecule in the universe. Molecular hydrogen later became a key ingredient in the formation of the first stars. At the time, the universe had entered a phase often called the cosmological "dark age." Matter had become transparent to light following recombination, but there were still no stars or galaxies producing visible light. Several hundred million years would pass before the first stars appeared. For those first stars to form, large clouds of gas had to collapse under their own gravity. To do that, the gas needed to cool by releasing energy. While hydrogen atoms can help with this process at high temperatures, they become less effective below about 10,000 degrees Celsius. Molecules can continue the cooling process by releasing energy through rotational and vibrational motions. Scientists have long considered HeH⁺ a potentially important coolant because of its comparatively large dipole moment, a property that describes how electric charge is distributed within a molecule and allows it to release energy efficiently. The amount of helium hydride present in the early universe may therefore have influenced how easily the first stars could form. At the same time, HeH⁺ was constantly being destroyed. Under primordial conditions, its main destruction mechanisms were recombination with free electrons and chemical reactions with hydrogen atoms. These reactions ultimately helped produce molecular hydrogen, linking the formation and destruction of HeH⁺ to the chemistry that shaped the early universe. For many years, theoretical studies suggested that reactions between HeH⁺ and hydrogen atoms would become much slower at low temperatures. Scientists believed there was an energy barrier along the reaction pathway that reduced the chances of the reaction taking place in the cold conditions of the early universe. The new study suggests otherwise. To investigate the process, researchers recreated a closely related reaction using deuterium, a naturally occurring isotope of hydrogen that contains one proton and one neutron in its nucleus. When HeH⁺ collides with deuterium, it forms an HD⁺ ion and a neutral helium atom. This allows scientists to study the reaction in a controlled way while closely mimicking the behaviour of the original reaction involving hydrogen. The experiments were carried out at the Cryogenic Storage Ring (CSR) at MPIK, a specialised facility designed to recreate conditions similar to those found in space. Researchers stored HeH⁺ ions in the 35-metre storage ring for up to 60 seconds at temperatures just a few kelvins above absolute zero and merged them with a beam of neutral deuterium atoms. By adjusting the speeds of the two particle beams, the team measured how the reaction rate changed with collision energy, which is directly related to temperature. The researchers found that the reaction rate remains almost constant as temperatures decrease. In other words, the reaction does not slow down at low temperatures as earlier models predicted. “Previous theories predicted a significant decrease in the reaction probability at low temperatures, but we were unable to verify this in either the experiment or new theoretical calculations by our colleagues,” explained Dr Holger Kreckel of MPIK. “The reactions of HeH⁺ with neutral hydrogen and deuterium therefore appear to have been far more important for chemistry in the early universe than previously assumed,” he continued. According to the researchers, the reaction appears to be barrierless, meaning there is no energy obstacle preventing it from taking place efficiently even at very low temperatures. The findings support recent theoretical work led by physicist Yohann Scribano, whose group identified an error in a widely used potential energy surface, a mathematical model used to describe how the energy of a system changes during a chemical reaction. The error appears to have caused previous studies to significantly underestimate reaction rates under primordial conditions. The new calculations closely match the experimental results. Together, they suggest that helium chemistry in the early universe may need to be re-evaluated. Because molecules such as HeH⁺ and molecular hydrogen played an important role in cooling primordial gas clouds, the findings could help scientists build more accurate models of how the first stars formed. By showing that helium hydride was likely destroyed more efficiently than previously thought, the study offers new insight into the chemical processes that shaped the universe during its earliest stages and helped set the conditions for the emergence of the first stars. Source: Max-Planck Institute, EDP Sciences This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • "What an interesting smell you've discovered"
    • It could EASILY be 70 for the base game BUT + lots of FOMO to make it up to 100-120, like a few days Early Access, online money, pre-order bonus cars, weapons, missions, clothing, avatars or profile stuff, etc... And still WAY TOO MANY people would buy those and make Rockstar insane money.
    • Just to understand: your solution to getting rid of an online password manager is...another online password manager?
    • Cjam 2.5.0.0 by Razvan Serea Cjam is a lightweight and fast MP3 editor for Windows that lets you cut, join, and edit MP3 files without re-encoding. This means your audio quality remains untouched, and edits happen instantly. Cjam is ideal for quick, lossless edits—whether you're trimming music, combining tracks, or preparing audio for learning tools or podcasts. It features batch processing, scripting support, cue and playlist file handling, and a simple interface. Cjam is perfect for anyone who needs efficient MP3 editing without the complexity of full audio suites. Cjam requires a PC running Windows 10 or later and Microsoft .NET 6.0 or later. Key features for Cjam: No Re-encoding: Edit MP3 files without losing quality. Cut and Join MP3: Easily cut, trim, and combine MP3 tracks. Batch Processing: Edit multiple files at once for faster workflows. Scriptable Interface: Automate tasks with a custom command language. Cue and Playlist Support: Handle CUE and playlist files for seamless audio management. Fast and Lightweight: Quick processing with minimal system resources. Lossless Audio Editing: Ensure your edits don't affect audio quality. Simple User Interface: Clean, intuitive design for easy navigation. File Format Support: Works with MP3, Cjam-specific file formats (CJAMC, CJAMJ, CJAM). Cjam 2.5.0.0 changelog: Added clipboard-based import/export support for mp3DirectCut Added clipboard-based export support for REAPER Added support for naming IMP3 elements Changed the Reset behavior to preserve Undo/Redo history; use Shift key + Reset button to clear it Added a new command parameter (qcp) Added 8 new entries to lang.txt (main_c124-126, main_d150-151, main_m082, vme_c014, vme_d005) Fixed a bug where the il parameter was incorrectly applied when pasting VMP3s into the main list Fixed several other minor bugs Download: Cjam 2.5.0.0 | 1.4 MB (Freeware) Links: Cjam Home Page | Cjam Manual | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Dedicated
      JuvenileDelinquent earned a badge
      Dedicated
    • First Post
      DrWankel earned a badge
      First Post
    • Reacting Well
      DrWankel earned a badge
      Reacting Well
    • Week One Done
      Supreme Spray LV earned a badge
      Week One Done
    • Week One Done
      Genuinetonerink- Dubai earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      504
    2. 2
      +Edouard
      163
    3. 3
      PsYcHoKiLLa
      91
    4. 4
      Steven P.
      75
    5. 5
      Michael Scrip
      72
  • Tell a friend

    Love Neowin? Tell a friend!