eradicating-malware-from-infected-systems

# Eradicating Malware from Infected Systems ## When to Use - Malware infection confirmed and containment is in place - Forensic investigation has identified all persistence mechanisms - All compromised systems have been identified and scoped - Ready to remove attacker artifacts and restore clean state - Post-containment phase requires systematic cleanup ## Prerequisites - Completed forensic analysis identifying all malware artifacts - List of all compromised systems and accounts - EDR/AV with updated signatures deployed - YARA rules for the specific malware family - Clean system images or verified backups for restoration - Network isolation still in effect during eradication ## Workflow ### Step 1: Map All Persistence Mechanisms ```bash # Windows - Check all known persistence locations # Autoruns (Sysinternals) - comprehensive autostart enumeration autorunsc.exe -accepteula -a * -c -h -s -v > autoruns_report.csv # Registry Run keys reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" /s reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" /s # Scheduled tasks schtasks /query /fo CSV /v > schtasks_all.csv # WMI event subscriptions Get-WMIObject -Namespace root\Subscription -Class __EventFilter Get-WMIObject -Namespace root\Subscription -Class CommandLineEventConsumer Get-WMIObject -Namespace root\Su...