Forget repairing virus infected systems, says MS security manager

[ams2d]

Originally posted here by brokencrow
Well, Danseglio obviously falls in the blame-it-on-stupid-users school, that's for sure. I'm ALWAYS leary of outfits that blame their own customers.

Me? I still think M$ pushes some bad product out the door...

Even when problems are found, Microsoft takes their time to fix them ...

Users urged to fix browser flaw

Guess if all else fails:

http://www.ssiworld.com/watch/computers.htm

[HTRegz]

Originally posted here by brokencrow
Sorry I didn't get to post this sooner. Busy, busy!

HT, you're point about using ghost is well taken (I've used it for years), but I have yet to see anyone I've ever worked for in a home/soho environment have a ghost image of their hdd. Many of these folks aren't even doing backups. Yeah, I can hear you now: they're idiots.

Typically, this is what I run into:

1) First hour spent running ass't scans and rooting thru the hdd looking for rogue files. I always run Spybot or Ad-Aware concurrently with an online AV scan. In this time, I'll also run Ccleaner concurrently, cleaning out the temp files. At the end of this first hour, I'm usually able to determine whether the install is salvageable or not. (1 hour)

2) If I've got to reinstall Windows, the client will often have me backup their data, which I usually do using a usb drive and Knoppix. This can take a long time, sometimes going overnight, which means two visits onsite. (1-8 hours)

3) Reinstalling Windows itself from scratch only takes an hour, unless there's driver issues. Then there's a series of Windows updates, which can run from an hour to two or three (depending on whether I've got SP's to install).

4) Once Windows is in, the computer needs to be secured with an AV app and some antispyware stuff. And those need to be updated. And Firefox needs to go in. Add another hour.

5) THEN, then I've got to get their apps back in, update those, and properly restore the user's data. Throw in another two or three hours.

These are often environments without servers. It's not unusual for my time on a protracted job to go a half day or even all day. So my first option is cleaning things out, not FNR's (flatten and reload). But, hey, I can go either way. Unfortunately, my idiots seldom see the wisdom of preparing for disaster and investing in backups like ghost, which by the way, isn't exactly cheap either.

Maybe it's the people I know... but many of them have ghost (or similar) backups of their systems... at the same time... the non-IT people that I know usually have back-ups of the important stuff in case they have to wipe..

As for cost.... the home user doesn't need Ghost... .they could buy LiveState Recovery Desktop (I have a few friends that use it... VMWare opens the images that this software creates (side note) )
http://www.symantec.com/Products/ent...info&refId=858
There's a buy online link off that page... you'll see it's only $99. That's not too much to ask.. they prolly pay you more in the end (I hope they do anyways... )

But if that's still a little too pricey... there are plenty of free alternatives..
g4u
G4L
HD Clone

Peace,
HT

[brokencrow]

...yar, I love it. A client of mine has a large shredder similar to the one pictured there (belted, not a bin). I've been bugging him to get into shredding hdd's (he does tons of paper), so one day he grabs a full-sized laptop and runs it thru. Came out in 1/4" strips. Couldn't believe it.

[ZT3000]

Guess if all else fails:

http://www.ssiworld.com/watch/computers.htm :

My initial thought when watching the crushing...

HEY...WAIT !! I'm sure we could make a good computer out of all these defunct boxes.

Grind Grind, Crush, Munch.

Well..at least the remaining debri could be used to piece together a Shuttle.

[The Texan]

off topic/ is the word debri or debris? HS was a over 3 years ago for me lol I have forgotten all my English

[ZT3000]

Dear The Texan,

You da' Man!

Seems my HS english was last century sometime.

:-)


(debris, it is)

[The Texan]

lol I thought so, but I just wanted to confirm maybe someone on here is an english major ( im not!)

[RoadClosed]

this guy even implies antivirus apps are about useless anymore

While I wouldn't say not to use them, I kind of agree.

[Galiath]

I will either reinstall the OS or clean the computer depending on a few variables.

1. If the computer is so infected it will barely run I'll either fix it to see how well I can get it running, and how much damage these malwares have actually done to the operating system.

Now if the client is extremely annoying I will have already informed them that there is no guarantee of whether or not this will work, sometimes doing both processes (the incident of the client paying enough to buy a new computer)

2. If the Clients PC has less than 2000 incidents from a Spysweeper scan, (or 750-900 from Spybot) I'll often clean the computer.

3. If the client informs me that there is no useful data, I will instantly GDisk it on the spot, and rebuild it.

4. If the computer is a PoS I'll often inform my clients to buy a new computer, and will transfer the data for them.

I like the challenge of cleaning extremely infected computers, and have seen some extremely bad ones, hundres of viruses and over 50000 hits on spyware scans, (multiple scans from a variety of programs) Hijackthis scans that span over 10-15 pages.

Now if its my personal machine, or a mission critical client system, you'd better believe I have 3 ghost images, with 2 of them offsite and will reimage them (after checking to see if I need to restore any data).

All-in-all I believe that its near impossible to fix a computer back to new standards if its been infected by viri, though Spyware you can often get back up and running.

and since I've seen the last few posts...

2 Odd Tools I always have on hand...

Hammer: useful for "fixing" certain annoying problems.
Drill: Might as well drill the dead hard drives.
Of course both of these strike fear in office managers around the world
*Grins Wickedly*

[brokencrow]

Why ruin a perfectly good boat anchor, Galiath? Like I always say, "Nothing wrong with this computer that 50 feet of anchor line won't fix."