Technical Discussion
>> Windows Issues

Pages in this thread: 1 | 2 | >> (show all)

Print Thread

pmb00cs
(eat-sleep-adslguide) Sun 18-Dec-11 11:03:14

Microsoft Standalone System Sweeper Beta

[link to this post]

Any one used it?

Is it any good?

I find myself in the rather unfortunate possition of needing to offer support to a family member who has done something rather silly. They were called by someone claiming they had information on problems with the PC, and then let them take remote control, and I now have to use an offline AV scanner in anger, I intend to use a clamAV based live CD, but the more tools available the better, so does anyone know if this one is any good?

happily chugging along on plusnet and Virginmedia (yes I am greedy)
My web server

Mikey2
(eat-sleep-adslguide) Sun 18-Dec-11 11:45:23

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

I've used Kaspersky Rescue Disk 10, though this was for a system that would not boot and it worked for me (or rather him after a similar escapade to yourself).

Mike
If you have to swallow a frog, try not to think about it. If you have to swallow two frogs, don't swallow the smaller one first.

pmb00cs
(eat-sleep-adslguide) Sun 18-Dec-11 11:57:20

Re: Microsoft Standalone System Sweeper Beta

[re: Mikey2] [link to this post]

Not that I'm paranoid, but I have a list,
F-Secure Rescue Disk
OpenDiagnostics (from VolatileMinds.net)
and
Microsoft Standalone System Sweeper

I'm hoping the three different utilities will, between them, catch the worst of the cruft.

Might try the Kaspersky Rescue disk too.

Don't know if the system boots or not, told them to unplug it from the wall after they rang me to ask if what they had done was stupid.

happily chugging along on plusnet and Virginmedia (yes I am greedy)
My web server

Zadeks
(committed) Sun 18-Dec-11 12:34:56

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

Stick MBAM with the latest definitions on a USB key. Boot to safe mode. Install MBAM, copy definitions over and scan.

pmb00cs
(eat-sleep-adslguide) Sun 18-Dec-11 13:05:04

Re: Microsoft Standalone System Sweeper Beta

[re: Zadeks] [link to this post]

At this point I refuse to trust the Windows Operating System installed upon the computer. Safe mode is only so safe if someone has had completed control of the PC. As much as I appreciate your advice (and I will no doubt look to malwarebytes to scan for malware once I trust the resident OS) my question is explicitly about offline AV for a reason.

happily chugging along on plusnet and Virginmedia (yes I am greedy)
My web server

Zadeks
(committed) Sun 18-Dec-11 13:13:31

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

Nothing is going to happen as long as the machine doesn't have a network connection. MBAM nukes 99% of trash unless it comes up against a stubborn rootkit in which case a dedicated rootkit removal tool such as GMER should be used.

Image the drive before doing anything if it contains important data.

pmb00cs
(eat-sleep-adslguide) Sun 18-Dec-11 13:25:55

Re: Microsoft Standalone System Sweeper Beta

[re: Zadeks] [link to this post]

Fortunately all important data is already backed up.

happily chugging along on plusnet and Virginmedia (yes I am greedy)
My web server

Pipexer
(eat-sleep-adslguide) Sun 18-Dec-11 16:15:57

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

If you don't trust what is installed on the computer then surely you must reformat and reinstall Windows. That is the only way to be sure.

______________
Zen 8000 Active

iand
(experienced) Sun 18-Dec-11 18:05:08

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

You could take the hard disk out of the PC and install into an external drive case and scan it from another PC, checking all files.

If you have all important files backed up, you can also reformat and install from scratch. I think I would do that in your situation.

IanD

Deadbeat
(knowledge is power) Sun 18-Dec-11 18:22:17

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

SuperAntiSpyware in Safe Mode should sort it along with HJT afterwards run in full mode.
SAS definitions can be downloaded here and I'll analyse any HJT log for you if you like.
But, first of all it is advisable to download the Kaspersky Rescue Disk ISO to a known clean machine, burn it on that machine and then boot the affected machine from the created CD. Make sure that the affected machine has internet access in order to update the Kaspersky definitions.

Edited by Deadbeat (Sun 18-Dec-11 18:27:22)

pmb00cs
(eat-sleep-adslguide) Wed 21-Dec-11 18:58:39

Re: Microsoft Standalone System Sweeper Beta

[re: pmb00cs] [link to this post]

To update you all, the PC in question only had a simple remote access trojan, which was easily removed. F-Secure Rescue disk got that. Nothing else found with Kaspersky Rescue Disk or OpenDiagnostic.

Rather Disapointingley the Microsoft Standalone System Sweeper failed to do anything, although this could be because of the dirt cheap USB stick I used to create it.

So I still don't know if it's any good.

happily chugging along on plusnet and Virginmedia (yes I am greedy)
My web server

Pages in this thread: 1 | 2 | >> (show all)

Print Thread

Jump to