For-pay AV program that will root out and remove as well as detect

[mset]

I spent an enjoyable few hours today ridding my Dad's computer of a Trojan.Vundo.H infection (hope I have that name right, it's from memory). It is hard to do this for my Dad via LogMeIn or over the phone. I want to buy him some protection. My question is this - I know that Kaspersky or ESET NOD 32 are both decent AV programs that will provide him with good real-time protection. However, I want to know if there is a program which is the leader in digging into an already infected computer and rooting out the problem and nuking it. The thing is, my Dad is 80 and although he's pretty tech savvy he still tends to click on things by accident or sort of unthinkingly.

I used MalwareBytes today and that seemed to get rid of Registry Defender (the Trojan) although I don't know what will happen when I reboot his rig. I had to use this in conjunction with ComboFix a few months back when he got XPAntivirus 2008 or whatever it was called.

Are these free programs along with an analysis of a HJT log the only/best solution or is there a program I can pay for that will give me the best chance of doing the in-depth scanning/registry fixes necessary to rid a computer of these pests after they have taken hold?

Hope that makes sense.

 

[mset]

Hmmm...perhaps I should read all the way through this.

http://forums.anandtech.com/me...=2108933&enterthread=y

 

[mechBgon]

Start by getting your dad onto a non-Admin account. Stuff generally can't put down roots like that without Admin powers lying around.

If the Windows version can do Software Restriction Policy, also set that up like shown here in addition to the non-Admin account. Now stuff generally won't even get a chance to try to put roots down, it'll be shot on sight by SRP.

Also, check the system with Secunia's Personal Software Inspector and fix what needs fixing. Make sure his system's automatic-update agent has been upgraded to Microsoft Update by going to http://update.microsoft.com, and that his Automatic Updates are set to full auto. Make sure his Data Execution Prevention is fully enabled.


Those improvements aren't just an incremental improvement, like Brand A antivirus versus Brand B antivirus. They fundamentally change the rules of the game, in your favor. And the beauty of these steps is that they are permanently free, have little or no performance impact, they protect your other layers of security from sabotage, and you can still add whatever antivirus / antispyware package you want, as the cherry on top.

 

[mset]

Originally posted by: mechBgon
Start by getting your dad onto a non-Admin account. Stuff generally can't put down roots like that without Admin powers lying around.

If the Windows version can do Software Restriction Policy, also set that up like shown here in addition to the non-Admin account. Now stuff generally won't even get a chance to try to put roots down, it'll be shot on sight by SRP.

Also, check the system with Secunia's Personal Software Inspector and fix what needs fixing. Make sure his system's automatic-update agent has been upgraded to Microsoft Update by going to http://update.microsoft.com, and that his Automatic Updates are set to full auto. Make sure his Data Execution Prevention is fully enabled.


Those improvements aren't just an incremental improvement, like Brand A antivirus versus Brand B antivirus. They fundamentally change the rules of the game, in your favor. And the beauty of these steps is that they are permanently free, have little or no performance impact, they protect your other layers of security from sabotage, and you can still add whatever antivirus / antispyware package you want, as the cherry on top.

I've posted for computer help on this site and also on techguy many times over the years, but that's one of the most helpful replies I've ever had. I had no idea that logging on as non-Admin could improve my chances of remaining infection free. I can't believe I've gone all these years without knowing that or hearing it.

I don't have time right now to review and act on all your instructions. I will do this later tonight. I'll implement these changes when I get home as well.

Thanks a lot.

By the way, here at my Dad's place it's Win XP Home Edition Version 2002 SP3

At home it's XP Pro SP3

 

[mechBgon]

I'm glad it was useful