Malware Removal Question

[Ankh Warrior]

Hi Brian,i'm watching your videos since 2011 and i learned a lot from you. I'm computer technician as well and i'm still learning new and more advanced stuff. Mostly what i do is remove malware,maintain computers,install operating systems,building PCs from scratch etc. I know a lot about malware removal but i want to raise it on higher level if you know what i mean I want to help other people here with malware infections but i'd like to learn how to make scripts for farbar,combofix,zoek etc. I signed up to another school but i'm still waiting an answer (i guess i will receive rejection) so if i learn from here it would be kindly appreciated

[GuiltySpark]

This should give you some idea about FRST .

As to combo fix you will have to sign up with Bleeping Computer and make about 20 posts before you can even be considered for their malware removal training course.

Zoek I've never used but I expect it's similar to combo fix in terms of training.

[Ankh Warrior]

Ok. I have some experience with FRST (still learning about it),yesterday i fixed machine with FRST only and i didn't screwed up anything. I've tried to get in MRT program at BC but it's always full for some reason. I applied for GeekU,still waiting an answer.

[Britec]

You're not alone, its probably a computer techs biggest weakness. Trouble with computer techs today is they know only one good way of cleaning a computer? format the computer back to default settings. There argument is..."its safer doing it this way" but the real truth is, they don't know how to remove malware correctly, apart from running malwarebytes and then they remove the software they used to clean malware from the machine and charge the customer a fee. 

They don't want the customer to know about free software like malwarebytes adwcleaner etc etc, because they know that customer will be back infected with malware again real soon. That is a sign of a bad tech. Inform your customer with good information on how to protect themselves against malware. Help them setup there machine and show them how to stay safe. 

I like you Ankh Warrior the way your trying to broaden your knowledge, that's a sign of a good tech. Now back to the question you asked before I get started on a rant about the modern day tech   Farbar is not that difficult to use. Just got to learn to read log files and spot malware. Everyone has there own way of removing malware, there is no wrong or right way. as long as the machine is clean at the end, that's all that matters. Farbar can speed up this process. But remember it don't always work or help removal all malware. Its a tool to use in conjunction other tools.

At this time, I wish our forum was receiving more malware removal questions so you can help and learn. But at this moment in time, the forum is a bit slow. Like GS said. you may need to join a forum that teach you the skills. But remember this can take a while and you would be expected to put time and effort in on the forum. helping with malware removal.

In the near future I will be releasing videos on another site on the whole process and all the tools you need. Been meaning on doing this for a while, it won't be free..but it will be well worth it.

Brian  

[Ankh Warrior]

Thanks Brian I know how to spot malware i've been watching all your videos and i learned a lot Anyway,i had a customer that had barely working computer so i had to use ComboFix to fix it. I usually install Toolwiz TimeFreeze to my customers because for some reason some of them are requesting help after 2 weeks And with Toolwiz,everything is undone after restart One of things i usually do is set their computers to maximum security and then set TimeFreeze + password just in case if someone disables it accidentally or on purpose.

[Ankh Warrior]

Brian what about group policy in FRST ? How to do it ?

[AdanClinton]

Best wishes for you and hope you will get what you want !

[Ankh Warrior]

Thank you

[Britec]

You mean this type of group policy?

Code:

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-2037850634-1991479139-3573102483-1003\User: Group Policy restriction detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

[Ankh Warrior]

Yes. How to fix that ?