Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

OS: Windows 7 Home Premium

Machine: Dell Inspiron N7010

Incident : User indicated that after clicking through what he later realized was a bogus Anti-Virus install message all his documents had 'diappeared.' Machine still boots into Windows successfully.

Ran in order :

1.Microsoft Security Essentials ( Full Scan ) and found

  • Java/Blacole.H ( 4 other instances with K,I,J,N appended )
  • Trojan: Win32/FakeSysDef

2.Microsoft Malicious Software Removal Tool ( Full Scan )

Nothing found

3.MalwareBytes ( Full Scan )

  • Trojan.FakeAlert ( 2 instances )

Probably just wiping this drive and restoring from Dell disks would be optimal...but for various reasons, this is not an option in this case.

After running these three programs and removing what was found, can we feel confident that the malware has been cleaned up as best as possible?

Is there anything else that should be run to clean the machine up?

share|improve this question
1  
See my post here, nothing is 100% except for a clean install.....superuser.com/questions/100360/… –  Moab Oct 18 '11 at 14:38
    
To everyone who voted to close: if somebody has a more specific case like this, you shouldn't necessarily vote to close it as a duplicate of our very general guidelines post. @mozzer, you should check out what to do if computer is infected by malware, then edit your question to include information about following all of the techniques there. If that solves your problem, you can self-answer what the exact issue was, otherwise, your edits can help people to better diagnose the problem. –  nhinkle Oct 18 '11 at 16:37

2 Answers 2

The direct answer is no - you cannot be confident. As @Moab says, if you have been compromised, there is no way to ensure you aren't still compromised. If the system owner can live with possible on-going compromise of their data and any accounts they access from this machine (banking, social media, etc), then what you've done is fine. If they are not, then it is time to rebuild.
But I would make sure the end user understands and makes that decision.

share|improve this answer

This question is impossible to answer. Definition based AV has its limits, and you've hit them. Now the question is do you just take the gamble or do a proper wipe? You can't just ask strangers to tell you yes or no and then tell the client what theyv'e told you. The reality of the situation is that its impossible to know. Tell that to your client who refuses the wipe.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.