One I am about to say is hard but I did it and in the long run helped out out great for any future infection.
If you have to reinstall the OS then visit every folder after a fresh install.
This is before you even install all the native drivers for the motherboard.
This way you have less folders to glance over. Just get used to the folder sizes and what lives in those directories.
Once you are familiar with each folder then go ahead and install all the drivers then see the changes and lots of folders made.
So once you see what a clean system looks like then you know files that mispelled or sound out of the ordinary then you can just boot into safemode and delete the alien files by hand.
Some times a virus is just a few files and sometimes there are many many many files so truly cleaning a system by hand is nearly impossible as also many times the infected fil would be marked invisible.
But the best way to treat a system so you do not have to reinstall everything owuld be to make an image clone of the hard drive like using NORTON GHOST which is a great tool for your OS.
That is... rather Draconian. Not to mention ineffective. Anything that involves the user memorizing tens of thousands of filenames so that they can recognize which ones don't belong is... a Bad Idea (TM). Not to mention, there is a lot of malware that mimic system filenames (e.g., a "svchost.exe" that lives in \Windows instead of \Windows\System32) or that don't reside in the Windows installation directory at all (a lot of malware these days install themselves somewhere in the user profile, to avoid UAC). And looking for size discrepancies won't work because good, well-written malware can fit under 1MB. Hell, it can even be under 100KB, depending on what the malware does and the competency of its author. That's a rounding error as far as extra disk space goes.
I think it's worth reminding people of the Cardinal Rule of Malware:
All code is inert, harmless data until executed.
I.e., I can load up a hard disk with thousands of samples of malware--something that would make an AV program wet itself with joy because it finally has something real to delete instead of the usual false positives. And it would pose absolutely no harm to me whatever, as long as I don't go and execute one of them.
With that in mind, the key to efficient
manual detection and removal isn't some unwieldy disk scan or monitoring, but rather, the targeting of that execution bottleneck. I.e., careful observation of what is loaded in memory (procexp with signature verification is very nice) and the ways in which code can load and execute without explicit user action (which is what autoruns is for).
Of course, if you get really, really bad malware--the rootkit kind that goes to extreme lengths to hide itself--then all bets are off, and I wouldn't trust anything short of an orbital nuke. But those things are very rare (unless you're a high-value target like a computer with government or corporate secrets) because they're very hard to correctly pull off, and most forms of malware do not have anywhere near that level of sophistication.
Facebook
Twitter