The latest types of malware are so potent that organisations should forget about trying to cleanse infected systems, a top Microsoft security officer has advised. Mike Danseglio, a program manager in Microsoft's security group, said firms should think about establishing a process for backup and recovering rather than relying on anti-virus tools as a way of recovering from malware infection.
http://www.theregister.com/2006/04/0...ity_mea_culpa/
I never had a virus when I ran Windows (that I know of), nor have I had one since running Linux. But if I did, I feel that a new install would be the best option. Otherwise, I would probably always be wondering if I had missed something. When people come to this site and ask for help dealing with such issues, and I read the advice they're given (boot into safe mode, run this, run that, etc) it seems to me that it's more trouble than it's worth. Reinstall, and be done with it. Be more careful next time.
I find it a telling admission, preacherman. Microsoft's really dropped the ball when it comes to security. Sheesh, this guy even implies antivirus apps are about useless anymore.
The more you post... the more I question your knowledge level with computers... Where has Microsoft dropped the ball with security? What they have said is very true and quite correct... It applies to all operating sytems... not just MS ones.Quote:
Originally posted here by brokencrow
I find it a telling admission, preacherman. Microsoft's really dropped the ball when it comes to security. Sheesh, this guy even implies antivirus apps are about useless anymore.
When a virus infects your computer... you CANNOT tell the extent of the damage... AV software doesn't remove everything... Trend Micro provides about the best AV protection you can get and even they don't catch anything... Let's look at this realistically..
Option A:
Set up a weekly back-up of your files... (Quantum's GoVault is a great personal back-up option... and it's brand new on the market... once others make similar products a price drop will be seen on this already reasonably priced product)... or use an external hard drive (5 - 10 minutes to start)
Reinstall when you're infected (60 minutes tops)
Total Time: 1 Hour and 15 minutes (we'll round each of these up to the nearest quarter hour)
Option B:
Take a weekly ghost image ( 5 - 10 minutes to start)
Restore your ghost image (30 minutes... maybe 60 if you include all your applications as well as the base OS... all depends on if it's restored from CD or across the network)
Total Time: 45 Minutes or 1 hour and 15 minutes.
Option C:
Scan with AV Software (At least one Online Variant and One Installable Variant)... (2- 3 hours)
Scan with a couple of types of malware remover (System Cleaner (Trend Micro), Spybot S&D, AdAware (Lavasoft), Defender (Microsoft)... (1 - 2 hours)
There are still plenty of other steps to be taken.... total time (so far) is already 5 hours on the high end... Seems like reinstalling is the right thing.. Especially in an Enterprise environment (which again is where Microsoft's interests lie)...
You cannot be sure that you've removed a virus/worm/trojan/rootkit after it's installed... a rogue registry key, a file in an obscure portion of the operating system...
Maybe it used something like H.D. Moore's Slacker... "Slacker - First ever tool that allows you to hide files within the slack space of the NTFS file system."
They always say if you're system is hacked reinstall... because you don't know what they've left behind... a virus is no different... if you're infected with a virus.... essentially you've been hacked... You don't know what that Virus has done.. has it provided a reverse-shell to the attacker... and they've left something behind...
Any sys admin with the slightest bit of intelligence will tell you that you should reinstall after a hack... and as I've said (and proven above) a virus is no different than a hack... people just don't think of it that way... which is wrong..
Therefore the proper thing to do is restore your system after a virus... it's the safest thing to do... and usually takes the least amount of time..
Peace,
HT
He really isn't admitting that "Microsoft has dropped the ball...." Actually he is questioning the worth of antivirus repair tools (not all antivirus apps).Quote:
I find it a telling admission, preacherman. Microsoft's really dropped the ball when it comes to security. Sheesh, this guy even implies antivirus apps are about useless anymore.
Well, Danseglio obviously falls in the blame-it-on-stupid-users school, that's for sure. I'm ALWAYS leary of outfits that blame their own customers.
Me? I still think M$ pushes some bad product out the door...
:(
Quote:
However Danseglio laid the blame for the majority of malware infections on human stupidity in the face of social engineering attacks rather than the security shortcomings of Windows, as highlighted by an unpatched Internet Explorer flaw that's become the focus of exploitation by hackers over recent days
That is still the main problem...uneducated user's, or slack IT procedures....I have yet to have to do a reinstall on a production machine (all WinXP Pro's), as long as you limit the potential for damage by the user, the PC's are fine, WinXp is a durable OS for all of it's supposedly flawed holes, who remember Win95 and 98 and always having problems with dll's and the registry,or the first round of popups and adware, now those I had to do a lot of formats and reinstalls.
As for:It's Gov't so they get what they pay for, doesn't surprise me they had over 2,000 infected machines, I would be willing to bet it was more, the "lowest bidder doesn't usually get the job" is well crap, Gov't 's will always go cheap, and not all dept's are able to get the bang for our buck. Also IMO Gov't's are notorious for being behind the learning curve on newer technology, (unless it's got something to do with weapons) and so are slow to implement policies.Consequently things get overlooked.Quote:
He cited the example of an unnamed US government agency that found itself trying to fix 2,000 infected machines. "In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden
Historically, the gov't has usually paid top-dollar, especially the military. I doubt those 2000 gov't units were military computers. Didn't MS sell the Pentagon a 'secure' version of Windows to the Pentagon? Those boys aren't stupid. Outnumbered maybe, but not stupid.
Why can't they sell a secure version of XP to the public? Secure out of the box.
Because the public wouldn't accept the restrictions... Just like they don't use Linux because it would mean they have to learn something about their computer rather than just use it....Quote:
Why can't they sell a secure version of XP to the public? Secure out of the box.
No brainer really....
Folks didn't like seatbelts back in the day either. Caused too many wrinkles in your clothes. ;)
Ahhh... I see... Quite the wild one...
But you want security.... It doesn't gel... Be wild or be secure... You can't really have both at the same time...
Be wild or be secure? Travel light, and you have the burden of neither. :cool:
That would be a philosophical discussion that doesn't deserve to be dicsussed here....
But I do believe you might be mislead....
No... I know you are... ;)
Misled? Moi?
Nah, we just got different pieces to the puzzle. Philosophy's part of that. Engineering, too. And experience.
Rumi once said there's a field out there, beyond right and wrong. I'll meet you there.
:p
1. the regular computer users arnt very smart about computers nor do they have the time like we do to learn about computers,
2. most people want an easy solution they can implament and not bother with the technical aspects , when ever i have a custumer i educate them as much as possible because if i take the time to explain things they are gonna know they can come to me later ,they are going to go hey this guy acually took the time to explain this to me now i have someone i can come to with a problem and he will acually explain things to me not making me look stupid, the normal everyday computer user is going to take you seriously rather than try to solve it on his or her own,end result of that last sentence is more people with sucure systems
what i wrote above comes from lots of trail and error dealing with custumers ,a computer is like a car you have to maintain it sucurity ,antivirus updates, and backing up comes under that catagory its easy to just say they are stupid but keep in mind that there are things they may be smart in that you arnt , everyone has diffrent talents just a matter of reconizing them and structure what you are teaching within what they know so its easy to understand , i understand this topic isint a philosophical discussion but it is releavant to what we are talking about
Hot Damn!
I am actually going to have to agree with HTRegz here.
If something gets past an AV then the AV has failed. "Cleaning" is an option you might consider for a home computer or if you are certain that you fully understand the nature of the attack (like it is a very simple malware). In a commercial environment this really isn't much of an option, in fact the restore approach is often the quickest as well as the safest.
I am speaking based on my last 15 years' experience................this is what happens in the real World of "enterprises".
It is also very common in the home PC support environment...................recover important data and scan it then do a reformat and reinstall. The customer is not going to pay the price of a new PC to have you do anything different?
OK stupid marketing/adware stuff can be removed IMO, but as soon as a machine has been "owned" you really have no choice other than to reformat and reinstall.
Personally I do not "blame" Microsoft, as I have used their products for years and have only ever been infected once.....................it was the "stoned" virus and I had to use something on a 5.25" floppy to get rid of it :D ......................I still have the PC...............it has a 10Mb HDD.............and I still have the virus on a 5.25" floppy :D
Just my £0.02
Just to add,
I remember at Uni, they had set all the labs to take a fresh image off the server EVERY time a machine was turned on!!!
This had positives and negatives. The positives are that no matter what we did to the PC we knew all we had to do was turn it off and on to have a fully working system again. They allowed nearly full priveledges to the machine as again as soon as it was reset it was taking a new image. Lastly it meant that they had almost no requirement for tech support.
The negatives were that if the machine crashed at all and you HAD to reset it you could wither wait 20 min for the image to finish, or move PC's. The latter was not always an option in a packed lab... Aditionally there must have been alot more wear and tear on certain components beacuse of that policy, and it meant that they ALWAYS left all the PCs on, even though the lab was closed from 10 at night until 8 in the morning, causing a bigger electricity bill.
I can definetely see the advantages of having a server image to install incase of infection if you're a company, and i can also see the point of attempting a clean if you're a home user.
They do this at my school (the name of the program escapes me, I think it's like "Deep Freeze" or something), I don't think they re-image that often, but definently once a week.Quote:
Originally posted here by ShippMA
I remember at Uni, they had set all the labs to take a fresh image off the server EVERY time a machine was turned on!!!
-back on topic-
Part of the problem is the fact that MS makes their products so easy to use (and obtain) that anyone can pick up some $400 eMachines PC running XP home from Best Buy then go to some sketchy site, get a virus, then let the virus go to town.
People feel that they are invicible on the internet, that they're invisible and what they do can't come back to bite them.
I agree with the MS Security officer, relating to rootkits and potent malware infections.
Reinstalling and not simply cleaning.
That being said, I've rarely reinstalled until the malware infections are 800 or over, sometimes more, but it depends on the type of infections and the way the computer operates. I know a local repair shop that encountered a record infection of multiple thousands in one machine!
I never was the type to reinstall on a virus infection, which gave me great experience in cleaning them (sometimes by hand using a disk editor, that was the Monkey virus among others.).
Don't remember a client ever complaining about my work, though.
If I was an Enterprise System Admin, I would definitely be concerned with "all of the above"!!
In an enterprise, things have a way of going from little to big in "no time at all" and that can affect alot of people.
Anyways, I have no idea where I was going with this post.
In an effort to at least give some value to this post, I make the following suggestion for Windows users (but not dual booters or partition manager bootups):
Get to know and use the MS Shared Computer toolkit.
The way I have it setup, anything (bad installs, malware, whatever) can infect my C: drive and I simply reboot and it's all gone.
My programs return to normal on C:, my data files, application data folder and My Documents stay updated on D: and I have the Shared toolkit unpartitioned space splitting both primary partitions.
If you are confused, read up on MS Shared Computer toolkit.
I've used Goback (successfully for years), Deep Freeze for about a week and some other programs of this nature, I find the toolkit much better than any of them.
Oh....don't forget to make off-site backups of your important files, in case the harddrive/computer takes a nose dive.
Sorry I didn't get to post this sooner. Busy, busy!
HT, you're point about using ghost is well taken (I've used it for years), but I have yet to see anyone I've ever worked for in a home/soho environment have a ghost image of their hdd. Many of these folks aren't even doing backups. Yeah, I can hear you now: they're idiots.
Typically, this is what I run into:
1) First hour spent running ass't scans and rooting thru the hdd looking for rogue files. I always run Spybot or Ad-Aware concurrently with an online AV scan. In this time, I'll also run Ccleaner concurrently, cleaning out the temp files. At the end of this first hour, I'm usually able to determine whether the install is salvageable or not. (1 hour)
2) If I've got to reinstall Windows, the client will often have me backup their data, which I usually do using a usb drive and Knoppix. This can take a long time, sometimes going overnight, which means two visits onsite. (1-8 hours)
3) Reinstalling Windows itself from scratch only takes an hour, unless there's driver issues. Then there's a series of Windows updates, which can run from an hour to two or three (depending on whether I've got SP's to install).
4) Once Windows is in, the computer needs to be secured with an AV app and some antispyware stuff. And those need to be updated. And Firefox needs to go in. Add another hour.
5) THEN, then I've got to get their apps back in, update those, and properly restore the user's data. Throw in another two or three hours.
These are often environments without servers. It's not unusual for my time on a protracted job to go a half day or even all day. So my first option is cleaning things out, not FNR's (flatten and reload). But, hey, I can go either way. Unfortunately, my idiots seldom see the wisdom of preparing for disaster and investing in backups like ghost, which by the way, isn't exactly cheap either.
Even when problems are found, Microsoft takes their time to fix them ...Quote:
Originally posted here by brokencrow
Well, Danseglio obviously falls in the blame-it-on-stupid-users school, that's for sure. I'm ALWAYS leary of outfits that blame their own customers.
Me? I still think M$ pushes some bad product out the door...
:(
Users urged to fix browser flaw
Guess if all else fails:
http://www.ssiworld.com/watch/computers.htm :)
Maybe it's the people I know... but many of them have ghost (or similar) backups of their systems... at the same time... the non-IT people that I know usually have back-ups of the important stuff in case they have to wipe..Quote:
Originally posted here by brokencrow
Sorry I didn't get to post this sooner. Busy, busy!
HT, you're point about using ghost is well taken (I've used it for years), but I have yet to see anyone I've ever worked for in a home/soho environment have a ghost image of their hdd. Many of these folks aren't even doing backups. Yeah, I can hear you now: they're idiots.
Typically, this is what I run into:
1) First hour spent running ass't scans and rooting thru the hdd looking for rogue files. I always run Spybot or Ad-Aware concurrently with an online AV scan. In this time, I'll also run Ccleaner concurrently, cleaning out the temp files. At the end of this first hour, I'm usually able to determine whether the install is salvageable or not. (1 hour)
2) If I've got to reinstall Windows, the client will often have me backup their data, which I usually do using a usb drive and Knoppix. This can take a long time, sometimes going overnight, which means two visits onsite. (1-8 hours)
3) Reinstalling Windows itself from scratch only takes an hour, unless there's driver issues. Then there's a series of Windows updates, which can run from an hour to two or three (depending on whether I've got SP's to install).
4) Once Windows is in, the computer needs to be secured with an AV app and some antispyware stuff. And those need to be updated. And Firefox needs to go in. Add another hour.
5) THEN, then I've got to get their apps back in, update those, and properly restore the user's data. Throw in another two or three hours.
These are often environments without servers. It's not unusual for my time on a protracted job to go a half day or even all day. So my first option is cleaning things out, not FNR's (flatten and reload). But, hey, I can go either way. Unfortunately, my idiots seldom see the wisdom of preparing for disaster and investing in backups like ghost, which by the way, isn't exactly cheap either.
As for cost.... the home user doesn't need Ghost... .they could buy LiveState Recovery Desktop (I have a few friends that use it... VMWare opens the images that this software creates (side note) )
http://www.symantec.com/Products/ent...info&refId=858
There's a buy online link off that page... you'll see it's only $99. That's not too much to ask.. they prolly pay you more in the end (I hope they do anyways... )
But if that's still a little too pricey... there are plenty of free alternatives..
g4u
G4L
HD Clone
Peace,
HT
...yar, I love it. A client of mine has a large shredder similar to the one pictured there (belted, not a bin). I've been bugging him to get into shredding hdd's (he does tons of paper), so one day he grabs a full-sized laptop and runs it thru. Came out in 1/4" strips. Couldn't believe it.
My initial thought when watching the crushing...Quote:
HEY...WAIT !! I'm sure we could make a good computer out of all these defunct boxes.
Grind Grind, Crush, Munch.
Well..at least the remaining debri could be used to piece together a Shuttle.
off topic/ is the word debri or debris? HS was a over 3 years ago for me lol I have forgotten all my English :)
Dear The Texan,
You da' Man!
Seems my HS english was last century sometime.
:-)
(debris, it is)
lol I thought so, but I just wanted to confirm maybe someone on here is an english major ( im not!) :)
While I wouldn't say not to use them, I kind of agree.Quote:
this guy even implies antivirus apps are about useless anymore
I will either reinstall the OS or clean the computer depending on a few variables.
1. If the computer is so infected it will barely run I'll either fix it to see how well I can get it running, and how much damage these malwares have actually done to the operating system.
Now if the client is extremely annoying I will have already informed them that there is no guarantee of whether or not this will work, sometimes doing both processes (the incident of the client paying enough to buy a new computer)
2. If the Clients PC has less than 2000 incidents from a Spysweeper scan, (or 750-900 from Spybot) I'll often clean the computer.
3. If the client informs me that there is no useful data, I will instantly GDisk it on the spot, and rebuild it.
4. If the computer is a PoS I'll often inform my clients to buy a new computer, and will transfer the data for them.
I like the challenge of cleaning extremely infected computers, and have seen some extremely bad ones, hundres of viruses and over 50000 hits on spyware scans, (multiple scans from a variety of programs) Hijackthis scans that span over 10-15 pages.
Now if its my personal machine, or a mission critical client system, you'd better believe I have 3 ghost images, with 2 of them offsite and will reimage them (after checking to see if I need to restore any data).
All-in-all I believe that its near impossible to fix a computer back to new standards if its been infected by viri, though Spyware you can often get back up and running.
and since I've seen the last few posts...
2 Odd Tools I always have on hand...
Hammer: useful for "fixing" certain annoying problems.
Drill: Might as well drill the dead hard drives.
Of course both of these strike fear in office managers around the world
*Grins Wickedly*
Why ruin a perfectly good boat anchor, Galiath? Like I always say, "Nothing wrong with this computer that 50 feet of anchor line won't fix."
Ah, but its always possible to use the box as a boat anchor after you've gone through and "Destroyed the data" Just put the sides back on the old 386, and it won't fall apart or rust through for the next 30 years... Even then most of the case will still be there and useful. (unless you prefer salt water).
I have layers upon layers. And I have to jet today and look at a PC I kicked off the domain last night. Now I don't mind going out to an office full of nice young ladies mind you. Tech support passes me some luser who's PC is rebooting with a little jingle playing. SO I have web filtering, fire wall scanning, email scanning once on the server, then again on the PC. Antispyware with MS and McAfee, Snort, On file access scanning and some **** that ties in with each NIC card and watches packets along with others stuff scanning all sorts of things. You can't keep up with all the friggin patches flying all over the place. Even with automated patching systems and dedicated heads to record and check things, stuff goes unchecked and lurking. But without all that money time and effort, the network would be unusable. "I didn't infect my pc." "Um since when have you heard windows play little jingles like that? Every time before black screening and shuting down?"