So- do these teach people how to use malware removal programs, or how to remove malware? personally I find removing malware myself to be quite a rewarding experience, although I must admit it is somewhat frustrating- around every three months or so I notice rundll32 running in my process list, which is a sure sign I'll be occupied for at least 45 minutes afterward- using a few malware removal tools, and those being unsuccessful, some manual investigation with REGEDIT and REGMON (I love that program. so useful), and maybe FILEMON if I find the need.
My weapons? a intimate knowledge of the registry, and a desire to eliminate these threats myself. Why, just this morning I removed some autorun entries twice in recovery console, only to find them reappear. I used REGMON to discover that WINLOGON was constantly writing to the autorun key the two malware values, so I immediately look in the HKLM\software\microsoft\windows nt\current version\winlogon\notify key to find that a new dll has decided to nest there. deleting all three DLL files at once in recovery console, as well as removing these registry entries in safe mode, and removing the relevant CLSID's from HKEY_CLASSES_ROOT\clsid has returned everything to normal. Strange thing was this was all caused by Firefox not loading a page more then once. As well as the friendly Ad aware SE telling me I had 8 threats (oh good, it'll get rid of these strange auto run keys)- nope. just bloody cookies. I guess they were newer malware as well, because Fix-it utilities didn't pick up any threats other then cookies either.
As I've said far too many times however- I kind of like being in total control of exactly what happens when the malware is removed. Far to often I find overzealous anti-virus or anti-malware doing things that are completely unnecessary, or deciding that what I REALLY wanted to do was defragment my hard drive, or something equally unhelpful in the context of malware removal. So I go solo, with no on-demand scanner (which I would have no choice but to install with IE- another topic altogether). people have called me foolish, and I can do nothing but agree at least partly.
