- Thread starter
- #81
C
cquirke (MVP Windows shell/user)
Re: Calling on a Guru to explain if I'm mistaken!
On Sun, 12 Aug 2007 09:58:03 -0700, MrSlartybartfast
>Yes, creating an image of a hard drive which has malware would include the
>malware in the image. When copying this image back to the hard drive, the
>malware would also be copied back resulting in net gain of zero.
This is why "just backup!" (as glibly stated) is as useless as "just
don't get viruses!" or "if you get infected, clean the virus!" etc.
All of these approaches work, but have complexity within them that
make for YMMV results. The complexity is similar across all three
contexts how one scopes out the bad guys. The mechanics of meeting
that inescapable challenge vary between the three "solutions".
>When I reinstall Windows, I reinstall off the original DVD which has
>no malware, unless you call Windows itself malware
This is using time as the great X-axis, i.e. the OS code base is as
old as possible, therefore excludes the malware. And so, the PC is
known to be clean.
But it also lacks every code patch needed to keep it that way, in the
face of direct exploits a la Lovesan or Sasser etc. and to patch
those, you'd have to expose this unpatched PC to the Internet.
It's also bereft of any applications and data. Presumably once can do
the same with applications and drivers as with the OS install
known-good baseline code from CDs and then patch these online, or
re-download apps and drivers from the 'net.
There's also no data, and another cruch comes here, because you
probably don't want a data set that's certain to be too old to be
infected you want your most recent backup, which is the one most
likely to be malware-tainted. How to scope data from malware?
Even though MS pushes "just" wipe and rebuild as the malware panacea,
they undermine these poiunts of failure:
- they generally don't ship replacement code on CDs or DVDs
- they don't attempt to separate data, code and incoming material
The first has improved, what with XP SP2 being released as a CD, and
with XP SP2 defaulting to firewall on.
There's little or no progess on the second, though still no clearly
visible distinction between data and code, still no type discipline so
malware can sprawl across file types and spoof the user and OS into
trusting these, incoming material is still hidden in mail stores and
mixed with "documents" etc.
In Vista, just what is backed up and what is not is even more opaque,
as there's little or no scoping by location at all.
>If the malware is on drive D:\ then it possibly could be reactivated on to
>drive C:\. You normally need to access the files on D:\ to reactivate the
>malware.
For values of "you" that includes the OS as a player. Even with a
wipe-and-rebuild that ensures no registry pointers to code on D:,
there can still be code autorun from D: via Desktop.ini, \Autorun.inf,
or the exploitation of any internal surfaces.
Such surfaces may present themselves to the material:
- when you do nothing at all, e.g. indexers, thumbnailers etc.
- when you "list" files in "folders"
- when a file name is displayed
>No antivirus is perfect either, antivirus programs can often miss finding
>some malware. I tend to find antivirus programs clunky and annoying and
>prefer not to use them.
I use them, as I think most users do. If you "don't need" an av, then
clearly you have solved the "don't get viruses" problem, and the
contexts of "clean the virus" and "rebuild and restore data" don't
arise. If they do arise, you were wong in thinking "don't get
viruses" was solved, and maybe you should rethink "I don't need an av"
(while I do agree that av will miss things).
Your nice freshly-built PC has no av, or an av installed from CD that
has an update status far worse than whatever was in effect when you
were infected. To update the av, you have to take this clean,
unpatched, un-protected-by-av system online...
>On my D:\ I compress my files individually which makes it hard for malware
>to emerge.
That helps. It also helps in av can traverse this compression for the
on-demand scans you'd want to do between rebuilding C: and installing
and updating av, and doing anythiing on D: or restoring "data".
>It is a painful process and takes a few hours so I do not do this very often.
I should hope not it's "last resort". If you have no confidence in
the ability to detect or avoid malware, do you do this just when
convenient, or whenever you "think you might be infected", or do you
do it every X days so attackers have "only" X days in which they can
harvest whatever they can grab off your PC?
>I do find this much easier than trying to live with an antivirus
>program installed. My choice is not for everyone
It might have been a best-fit in the DOS era, when "don't get viruses"
was as easy as "boot C: before A: and don't run .EXE, .COM and .BAT
files". By now, a single resident av poses little or no system
impact, whereas the wipe-and-rebuild process is a PITA.
Frankly, doing a wipe-and-rebuild every now and then on a PC that's
probably clean anyway, will increase the risks of infection.
Do the maths you either get infected so often that the risks of
falling back to unpatched code hardly makes things worse, in which
case whatever you (blindly) do is equally useless, or your approach
works so well that falling back to unpatched code is your single
biggest risk of infection, and to improve things, you should stop
doing that. If you have no ability to tell whether you are or have
ever been infected, you can't distingusish between these states.
>as I said before I have no valuable information stored on
>my PC, I do not own a credit card and do not use internet
>banking. If I have malware then I can live with it.
Most of us want better results than that, and generally attain them.
Why are we reading this advice again?
>The AUMHA forum you linked to as a recommendation for Nanoscan and Totalscan
>does nothing for me, it is hardly a review. Panda Software is well known, so
>this is not one of the fake virus scans which is on the web. Out of
>curiosity I started to run it anyway, I did not continue since I do not yet
>fully understand the software and am not prepared to install the files on my
>PC. You may use this if you wish but it is not for me.
I agree with you there, especially if you suspect the PC is infected.
How do you know the site you reached, is not a malware look-alike that
resident malware has spoofed you to? Is it really a good idea to...
- disable resident av
- run Internet Explorer in admin mode so as to drop protection
- say "yes" to all ActiveX etc. prompts
- allow the site to drop and run code
- stay online while this code "scans" all your files
....as the advice at such sites generally suggests?
>The bots which harvest email addresses off the internet are just that, bots.
> They scour the entire internet, not just microsoft newsgroups. To be safe,
>never use your real name, never give your address, phone number or contact
>details, create temporary email accounts to use to sign up to forums and
>newsgroups,
Bots are unbounded, because:
- they can update themselves
- they facilitate unbounded interaction from external entities
Those external entities may be other bots or humans. In essence, an
active bot dissolves confidence in the distinction between "this
system" and "the Internet" (or more more accurately, "the infosphere",
as local attacks via WiFi may also be facilitated).
>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -
On Sun, 12 Aug 2007 09:58:03 -0700, MrSlartybartfast
>Yes, creating an image of a hard drive which has malware would include the
>malware in the image. When copying this image back to the hard drive, the
>malware would also be copied back resulting in net gain of zero.
This is why "just backup!" (as glibly stated) is as useless as "just
don't get viruses!" or "if you get infected, clean the virus!" etc.
All of these approaches work, but have complexity within them that
make for YMMV results. The complexity is similar across all three
contexts how one scopes out the bad guys. The mechanics of meeting
that inescapable challenge vary between the three "solutions".
>When I reinstall Windows, I reinstall off the original DVD which has
>no malware, unless you call Windows itself malware
This is using time as the great X-axis, i.e. the OS code base is as
old as possible, therefore excludes the malware. And so, the PC is
known to be clean.
But it also lacks every code patch needed to keep it that way, in the
face of direct exploits a la Lovesan or Sasser etc. and to patch
those, you'd have to expose this unpatched PC to the Internet.
It's also bereft of any applications and data. Presumably once can do
the same with applications and drivers as with the OS install
known-good baseline code from CDs and then patch these online, or
re-download apps and drivers from the 'net.
There's also no data, and another cruch comes here, because you
probably don't want a data set that's certain to be too old to be
infected you want your most recent backup, which is the one most
likely to be malware-tainted. How to scope data from malware?
Even though MS pushes "just" wipe and rebuild as the malware panacea,
they undermine these poiunts of failure:
- they generally don't ship replacement code on CDs or DVDs
- they don't attempt to separate data, code and incoming material
The first has improved, what with XP SP2 being released as a CD, and
with XP SP2 defaulting to firewall on.
There's little or no progess on the second, though still no clearly
visible distinction between data and code, still no type discipline so
malware can sprawl across file types and spoof the user and OS into
trusting these, incoming material is still hidden in mail stores and
mixed with "documents" etc.
In Vista, just what is backed up and what is not is even more opaque,
as there's little or no scoping by location at all.
>If the malware is on drive D:\ then it possibly could be reactivated on to
>drive C:\. You normally need to access the files on D:\ to reactivate the
>malware.
For values of "you" that includes the OS as a player. Even with a
wipe-and-rebuild that ensures no registry pointers to code on D:,
there can still be code autorun from D: via Desktop.ini, \Autorun.inf,
or the exploitation of any internal surfaces.
Such surfaces may present themselves to the material:
- when you do nothing at all, e.g. indexers, thumbnailers etc.
- when you "list" files in "folders"
- when a file name is displayed
>No antivirus is perfect either, antivirus programs can often miss finding
>some malware. I tend to find antivirus programs clunky and annoying and
>prefer not to use them.
I use them, as I think most users do. If you "don't need" an av, then
clearly you have solved the "don't get viruses" problem, and the
contexts of "clean the virus" and "rebuild and restore data" don't
arise. If they do arise, you were wong in thinking "don't get
viruses" was solved, and maybe you should rethink "I don't need an av"
(while I do agree that av will miss things).
Your nice freshly-built PC has no av, or an av installed from CD that
has an update status far worse than whatever was in effect when you
were infected. To update the av, you have to take this clean,
unpatched, un-protected-by-av system online...
>On my D:\ I compress my files individually which makes it hard for malware
>to emerge.
That helps. It also helps in av can traverse this compression for the
on-demand scans you'd want to do between rebuilding C: and installing
and updating av, and doing anythiing on D: or restoring "data".
>It is a painful process and takes a few hours so I do not do this very often.
I should hope not it's "last resort". If you have no confidence in
the ability to detect or avoid malware, do you do this just when
convenient, or whenever you "think you might be infected", or do you
do it every X days so attackers have "only" X days in which they can
harvest whatever they can grab off your PC?
>I do find this much easier than trying to live with an antivirus
>program installed. My choice is not for everyone
It might have been a best-fit in the DOS era, when "don't get viruses"
was as easy as "boot C: before A: and don't run .EXE, .COM and .BAT
files". By now, a single resident av poses little or no system
impact, whereas the wipe-and-rebuild process is a PITA.
Frankly, doing a wipe-and-rebuild every now and then on a PC that's
probably clean anyway, will increase the risks of infection.
Do the maths you either get infected so often that the risks of
falling back to unpatched code hardly makes things worse, in which
case whatever you (blindly) do is equally useless, or your approach
works so well that falling back to unpatched code is your single
biggest risk of infection, and to improve things, you should stop
doing that. If you have no ability to tell whether you are or have
ever been infected, you can't distingusish between these states.
>as I said before I have no valuable information stored on
>my PC, I do not own a credit card and do not use internet
>banking. If I have malware then I can live with it.
Most of us want better results than that, and generally attain them.
Why are we reading this advice again?
>The AUMHA forum you linked to as a recommendation for Nanoscan and Totalscan
>does nothing for me, it is hardly a review. Panda Software is well known, so
>this is not one of the fake virus scans which is on the web. Out of
>curiosity I started to run it anyway, I did not continue since I do not yet
>fully understand the software and am not prepared to install the files on my
>PC. You may use this if you wish but it is not for me.
I agree with you there, especially if you suspect the PC is infected.
How do you know the site you reached, is not a malware look-alike that
resident malware has spoofed you to? Is it really a good idea to...
- disable resident av
- run Internet Explorer in admin mode so as to drop protection
- say "yes" to all ActiveX etc. prompts
- allow the site to drop and run code
- stay online while this code "scans" all your files
....as the advice at such sites generally suggests?
>The bots which harvest email addresses off the internet are just that, bots.
> They scour the entire internet, not just microsoft newsgroups. To be safe,
>never use your real name, never give your address, phone number or contact
>details, create temporary email accounts to use to sign up to forums and
>newsgroups,
Bots are unbounded, because:
- they can update themselves
- they facilitate unbounded interaction from external entities
Those external entities may be other bots or humans. In essence, an
active bot dissolves confidence in the distinction between "this
system" and "the Internet" (or more more accurately, "the infosphere",
as local attacks via WiFi may also be facilitated).
>-------------------- ----- ---- --- -- - - - -
Running Windows-based av to kill active malware is like striking
a match to see if what you are standing in is water or petrol.
>-------------------- ----- ---- --- -- - - - -