Preferred RootKit detection/removal tool?

[Spin]

Gurus,

I know Symantec offers RootKit detection tools, as does Panda Security,
F-Secure, to name a few. However, this is addressed to those of you in this
newsgroup, which of those do you prefer to use "out in the field"?

--
Spin

 

[Steve Riley [MSFT]]

SETUP.EXE on the Windows installation DVD

Seriously, I'd rather just wipe-and-rebuild than try to disinfect. How can
you know you're completely clean otherwise?

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"Spin" <Spin@invalid.com> wrote in message
news:6gp43oFgvp55U1@mid.individual.net...
> Gurus,
>
> I know Symantec offers RootKit detection tools, as does Panda Security,
> F-Secure, to name a few. However, this is addressed to those of you in
> this newsgroup, which of those do you prefer to use "out in the field"?
>
> --
> Spin

 

[PA Bear [MS MVP]]

9 times out of 10, we end up ripping them out by the roots...or doing a
"wipe & reload."
--
~Robear Dyer (PA Bear)
MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.net/

Spin wrote:
> I know Symantec offers RootKit detection tools, as does Panda Security,
> F-Secure, to name a few. However, this is addressed to those of you in
> this
> newsgroup, which of those do you prefer to use "out in the field"?

 

[Dan]

Steve and Robear, I was wondering if that was as clean as a format and clean
install or is my wording just different and means the same thing. <?>

"PA Bear [MS MVP]" wrote:

> 9 times out of 10, we end up ripping them out by the roots...or doing a
> "wipe & reload."
> --
> ~Robear Dyer (PA Bear)
> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> AumHa VSOP & Admin http://aumha.net
> DTS-L http://dts-l.net/
>
> Spin wrote:
> > I know Symantec offers RootKit detection tools, as does Panda Security,
> > F-Secure, to name a few. However, this is addressed to those of you in
> > this
> > newsgroup, which of those do you prefer to use "out in the field"?
>
>

 

[FromTheRafters]

Wipe is "cleaner" than format, and reload is dependent on
exactly what is reloaded.

"Dan" <Dan@discussions.microsoft.com> wrote in message
news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
> Steve and Robear, I was wondering if that was as clean as a format and
> clean
> install or is my wording just different and means the same thing. <?>
>
> "PA Bear [MS MVP]" wrote:
>
>> 9 times out of 10, we end up ripping them out by the roots...or doing a
>> "wipe & reload."
>> --
>> ~Robear Dyer (PA Bear)
>> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> AumHa VSOP & Admin http://aumha.net
>> DTS-L http://dts-l.net/
>>
>> Spin wrote:
>> > I know Symantec offers RootKit detection tools, as does Panda Security,
>> > F-Secure, to name a few. However, this is addressed to those of you in
>> > this
>> > newsgroup, which of those do you prefer to use "out in the field"?
>>
>>

 

[Dan]

Thank you. For instance, a DOD wipe is done before a clean installation for
better safety and security. I would imagine, the only true safety on a drive
is to perform this and then totally annihilate the hard drive if it contains
classified and/or sensitive information.

"FromTheRafters" wrote:

> Wipe is "cleaner" than format, and reload is dependent on
> exactly what is reloaded.
>
> "Dan" <Dan@discussions.microsoft.com> wrote in message
> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
> > Steve and Robear, I was wondering if that was as clean as a format and
> > clean
> > install or is my wording just different and means the same thing. <?>
> >
> > "PA Bear [MS MVP]" wrote:
> >
> >> 9 times out of 10, we end up ripping them out by the roots...or doing a
> >> "wipe & reload."
> >> --
> >> ~Robear Dyer (PA Bear)
> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> AumHa VSOP & Admin http://aumha.net
> >> DTS-L http://dts-l.net/
> >>
> >> Spin wrote:
> >> > I know Symantec offers RootKit detection tools, as does Panda Security,
> >> > F-Secure, to name a few. However, this is addressed to those of you in
> >> > this
> >> > newsgroup, which of those do you prefer to use "out in the field"?
> >>
> >>
>
>
>

 

[Steve Riley [MSFT]]

A simple format and reinstall is sufficient to have a fresh clean copy of
the OS without malware.

Multi-pass wipes aren't necessary unless you want to ensure there's nothing
remaining when you sell or give away the drive.

--
Steve Riley
steve.riley@microsoft.com
http://blogs.technet.com/steriley
http://www.protectyourwindowsnetwork.com



"Dan" <Dan@discussions.microsoft.com> wrote in message
news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
> Thank you. For instance, a DOD wipe is done before a clean installation
> for
> better safety and security. I would imagine, the only true safety on a
> drive
> is to perform this and then totally annihilate the hard drive if it
> contains
> classified and/or sensitive information.
>
> "FromTheRafters" wrote:
>
>> Wipe is "cleaner" than format, and reload is dependent on
>> exactly what is reloaded.
>>
>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
>> > Steve and Robear, I was wondering if that was as clean as a format and
>> > clean
>> > install or is my wording just different and means the same thing. <?>
>> >
>> > "PA Bear [MS MVP]" wrote:
>> >
>> >> 9 times out of 10, we end up ripping them out by the roots...or doing
>> >> a
>> >> "wipe & reload."
>> >> --
>> >> ~Robear Dyer (PA Bear)
>> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> >> AumHa VSOP & Admin http://aumha.net
>> >> DTS-L http://dts-l.net/
>> >>
>> >> Spin wrote:
>> >> > I know Symantec offers RootKit detection tools, as does Panda
>> >> > Security,
>> >> > F-Secure, to name a few. However, this is addressed to those of you
>> >> > in
>> >> > this
>> >> > newsgroup, which of those do you prefer to use "out in the field"?
>> >>
>> >>
>>
>>
>>

 

[Dan]

Thanks for the reply, Steve.

"Steve Riley [MSFT]" wrote:

> A simple format and reinstall is sufficient to have a fresh clean copy of
> the OS without malware.
>
> Multi-pass wipes aren't necessary unless you want to ensure there's nothing
> remaining when you sell or give away the drive.
>
> --
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
> http://www.protectyourwindowsnetwork.com
>
>
>
> "Dan" <Dan@discussions.microsoft.com> wrote in message
> news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
> > Thank you. For instance, a DOD wipe is done before a clean installation
> > for
> > better safety and security. I would imagine, the only true safety on a
> > drive
> > is to perform this and then totally annihilate the hard drive if it
> > contains
> > classified and/or sensitive information.
> >
> > "FromTheRafters" wrote:
> >
> >> Wipe is "cleaner" than format, and reload is dependent on
> >> exactly what is reloaded.
> >>
> >> "Dan" <Dan@discussions.microsoft.com> wrote in message
> >> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
> >> > Steve and Robear, I was wondering if that was as clean as a format and
> >> > clean
> >> > install or is my wording just different and means the same thing. <?>
> >> >
> >> > "PA Bear [MS MVP]" wrote:
> >> >
> >> >> 9 times out of 10, we end up ripping them out by the roots...or doing
> >> >> a
> >> >> "wipe & reload."
> >> >> --
> >> >> ~Robear Dyer (PA Bear)
> >> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> >> AumHa VSOP & Admin http://aumha.net
> >> >> DTS-L http://dts-l.net/
> >> >>
> >> >> Spin wrote:
> >> >> > I know Symantec offers RootKit detection tools, as does Panda
> >> >> > Security,
> >> >> > F-Secure, to name a few. However, this is addressed to those of you
> >> >> > in
> >> >> > this
> >> >> > newsgroup, which of those do you prefer to use "out in the field"?
> >> >>
> >> >>
> >>
> >>
> >>

 

[FromTheRafters]

You only need DOD level overwrites if you intend to
erradicate most all probability that anyone can obtain
any valid data from the drive. Removing a early boot
axis rootkit doesn't require that much - a simple one
time pass of overwite will do. The difference between
a format and a simple wipe is just that a format won't
touch all of the boot areas on the disk.

To remove malicious data from a disk does not require
seven+ overwrites or halftracking. In fact wiping isn't
even really necessary as long as whatever you do does
also touch the areas involved in the boot axis.

"Dan" <Dan@discussions.microsoft.com> wrote in message
news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
> Thank you. For instance, a DOD wipe is done before a clean installation
> for
> better safety and security. I would imagine, the only true safety on a
> drive
> is to perform this and then totally annihilate the hard drive if it
> contains
> classified and/or sensitive information.
>
> "FromTheRafters" wrote:
>
>> Wipe is "cleaner" than format, and reload is dependent on
>> exactly what is reloaded.
>>
>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
>> > Steve and Robear, I was wondering if that was as clean as a format and
>> > clean
>> > install or is my wording just different and means the same thing. <?>
>> >
>> > "PA Bear [MS MVP]" wrote:
>> >
>> >> 9 times out of 10, we end up ripping them out by the roots...or doing
>> >> a
>> >> "wipe & reload."
>> >> --
>> >> ~Robear Dyer (PA Bear)
>> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>> >> AumHa VSOP & Admin http://aumha.net
>> >> DTS-L http://dts-l.net/
>> >>
>> >> Spin wrote:
>> >> > I know Symantec offers RootKit detection tools, as does Panda
>> >> > Security,
>> >> > F-Secure, to name a few. However, this is addressed to those of you
>> >> > in
>> >> > this
>> >> > newsgroup, which of those do you prefer to use "out in the field"?
>> >>
>> >>
>>
>>
>>

 

[FromTheRafters]

If your OS has been severely compromised, you don't want to
use the copy of format.com that is on that machine to do the
format. In the old days, the "rootkit" was a collection of utilities
and tools that were modified from their original to something
perhaps nefarious. If someone had root access they could
replace the formatting tool with one that only appears to format
the drive. As long as the act of formatting and reinstalling touches
the boot axis areas of the disk then any trace of malware should
be overwritten or no longer linked to.

There is some malware (I forget the name(s)) that affect the boot
areas of the disk, and IIRC simple format won't affect that area.
You probably are just left with an unbootable drive unless the
area is repaired.

"Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
news:29FE1A85-1B8E-45DB-AFFD-D1638829676A@microsoft.com...
>A simple format and reinstall is sufficient to have a fresh clean copy of
>the OS without malware.
>
> Multi-pass wipes aren't necessary unless you want to ensure there's
> nothing remaining when you sell or give away the drive.
>
> --
> Steve Riley
> steve.riley@microsoft.com
> http://blogs.technet.com/steriley
> http://www.protectyourwindowsnetwork.com
>
>
>
> "Dan" <Dan@discussions.microsoft.com> wrote in message
> news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
>> Thank you. For instance, a DOD wipe is done before a clean installation
>> for
>> better safety and security. I would imagine, the only true safety on a
>> drive
>> is to perform this and then totally annihilate the hard drive if it
>> contains
>> classified and/or sensitive information.
>>
>> "FromTheRafters" wrote:
>>
>>> Wipe is "cleaner" than format, and reload is dependent on
>>> exactly what is reloaded.
>>>
>>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>>> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
>>> > Steve and Robear, I was wondering if that was as clean as a format and
>>> > clean
>>> > install or is my wording just different and means the same thing. <?>
>>> >
>>> > "PA Bear [MS MVP]" wrote:
>>> >
>>> >> 9 times out of 10, we end up ripping them out by the roots...or doing
>>> >> a
>>> >> "wipe & reload."
>>> >> --
>>> >> ~Robear Dyer (PA Bear)
>>> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>> >> AumHa VSOP & Admin http://aumha.net
>>> >> DTS-L http://dts-l.net/
>>> >>
>>> >> Spin wrote:
>>> >> > I know Symantec offers RootKit detection tools, as does Panda
>>> >> > Security,
>>> >> > F-Secure, to name a few. However, this is addressed to those of
>>> >> > you in
>>> >> > this
>>> >> > newsgroup, which of those do you prefer to use "out in the field"?
>>> >>
>>> >>
>>>
>>>
>>>

 

[Dan]

Thanks for your replies.

"FromTheRafters" wrote:

> You only need DOD level overwrites if you intend to
> erradicate most all probability that anyone can obtain
> any valid data from the drive. Removing a early boot
> axis rootkit doesn't require that much - a simple one
> time pass of overwite will do. The difference between
> a format and a simple wipe is just that a format won't
> touch all of the boot areas on the disk.
>
> To remove malicious data from a disk does not require
> seven+ overwrites or halftracking. In fact wiping isn't
> even really necessary as long as whatever you do does
> also touch the areas involved in the boot axis.
>
> "Dan" <Dan@discussions.microsoft.com> wrote in message
> news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
> > Thank you. For instance, a DOD wipe is done before a clean installation
> > for
> > better safety and security. I would imagine, the only true safety on a
> > drive
> > is to perform this and then totally annihilate the hard drive if it
> > contains
> > classified and/or sensitive information.
> >
> > "FromTheRafters" wrote:
> >
> >> Wipe is "cleaner" than format, and reload is dependent on
> >> exactly what is reloaded.
> >>
> >> "Dan" <Dan@discussions.microsoft.com> wrote in message
> >> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
> >> > Steve and Robear, I was wondering if that was as clean as a format and
> >> > clean
> >> > install or is my wording just different and means the same thing. <?>
> >> >
> >> > "PA Bear [MS MVP]" wrote:
> >> >
> >> >> 9 times out of 10, we end up ripping them out by the roots...or doing
> >> >> a
> >> >> "wipe & reload."
> >> >> --
> >> >> ~Robear Dyer (PA Bear)
> >> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
> >> >> AumHa VSOP & Admin http://aumha.net
> >> >> DTS-L http://dts-l.net/
> >> >>
> >> >> Spin wrote:
> >> >> > I know Symantec offers RootKit detection tools, as does Panda
> >> >> > Security,
> >> >> > F-Secure, to name a few. However, this is addressed to those of you
> >> >> > in
> >> >> > this
> >> >> > newsgroup, which of those do you prefer to use "out in the field"?
> >> >>
> >> >>
> >>
> >>
> >>
>
>
>

 

[Richard Urban]

I believe that if you delete all the partitions from the drive, apply the
changes and then create a new partition - a new MBR is created. A boot
sector virus should not survive this action.

I seem to remember that I did just that about 8 years ago to remove a boot
sector virus from a friends computer.

But then, it was 8 years ago! (-:

--

Richard Urban
Microsoft MVP
Windows Desktop Experience


"FromTheRafters" <erratic@ne.rr.com> wrote in message
news:eidn5OmAJHA.4256@TK2MSFTNGP05.phx.gbl...
> If your OS has been severely compromised, you don't want to
> use the copy of format.com that is on that machine to do the
> format. In the old days, the "rootkit" was a collection of utilities
> and tools that were modified from their original to something
> perhaps nefarious. If someone had root access they could
> replace the formatting tool with one that only appears to format
> the drive. As long as the act of formatting and reinstalling touches
> the boot axis areas of the disk then any trace of malware should
> be overwritten or no longer linked to.
>
> There is some malware (I forget the name(s)) that affect the boot
> areas of the disk, and IIRC simple format won't affect that area.
> You probably are just left with an unbootable drive unless the
> area is repaired.
>
> "Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
> news:29FE1A85-1B8E-45DB-AFFD-D1638829676A@microsoft.com...
>>A simple format and reinstall is sufficient to have a fresh clean copy of
>>the OS without malware.
>>
>> Multi-pass wipes aren't necessary unless you want to ensure there's
>> nothing remaining when you sell or give away the drive.
>>
>> --
>> Steve Riley
>> steve.riley@microsoft.com
>> http://blogs.technet.com/steriley
>> http://www.protectyourwindowsnetwork.com
>>
>>
>>
>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>> news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
>>> Thank you. For instance, a DOD wipe is done before a clean installation
>>> for
>>> better safety and security. I would imagine, the only true safety on a
>>> drive
>>> is to perform this and then totally annihilate the hard drive if it
>>> contains
>>> classified and/or sensitive information.
>>>
>>> "FromTheRafters" wrote:
>>>
>>>> Wipe is "cleaner" than format, and reload is dependent on
>>>> exactly what is reloaded.
>>>>
>>>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>>>> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
>>>> > Steve and Robear, I was wondering if that was as clean as a format
>>>> > and
>>>> > clean
>>>> > install or is my wording just different and means the same thing.
>>>> > <?>
>>>> >
>>>> > "PA Bear [MS MVP]" wrote:
>>>> >
>>>> >> 9 times out of 10, we end up ripping them out by the roots...or
>>>> >> doing a
>>>> >> "wipe & reload."
>>>> >> --
>>>> >> ~Robear Dyer (PA Bear)
>>>> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>> >> AumHa VSOP & Admin http://aumha.net
>>>> >> DTS-L http://dts-l.net/
>>>> >>
>>>> >> Spin wrote:
>>>> >> > I know Symantec offers RootKit detection tools, as does Panda
>>>> >> > Security,
>>>> >> > F-Secure, to name a few. However, this is addressed to those of
>>>> >> > you in
>>>> >> > this
>>>> >> > newsgroup, which of those do you prefer to use "out in the field"?
>>>> >>
>>>> >>
>>>>
>>>>
>>>>
>
>

 

[Roger Abell [MVP]]

Spin,
Your subject asks about detection, whereas it seem responses have
been about cleanup once a system has one. The only real way that
I am aware of for detection that does cover both major divisions of
root kits requires an offline analysis of the machine to be confirmed
"probably" root kit free.
So that does rule out most of the tools in the class you mentioned.
Roger

"Spin" <Spin@invalid.com> wrote in message
news:6gp43oFgvp55U1@mid.individual.net...
> Gurus,
>
> I know Symantec offers RootKit detection tools, as does Panda Security,
> F-Secure, to name a few. However, this is addressed to those of you in
> this newsgroup, which of those do you prefer to use "out in the field"?
>
> --
> Spin

 

[FromTheRafters]

Yes, but formating and partitioning are two different
things. Even when partitioning is the subject, IIRC
the boot areas are not fixed by default unless there
is no marker (flag?) found indicating there is a valid
boot sector present.

Anyway - when rootkits or other very sticky malware
are concerned it is best to fix the boot axis as well as
making the data stored by the filesystem inaccessible
or invalid. Format addresses the latter, but not the
former (unless they changed something I am not aware
of). )

Fixmbr or fdisk /mbr probably - or the old bootsect.exe
'bootsect write bootsect.bak' sound familiar?

"Richard Urban" <richardurbanREMOVETHIS@hotmail.com> wrote in message
news:e4FmDEqAJHA.528@TK2MSFTNGP06.phx.gbl...
>I believe that if you delete all the partitions from the drive, apply the
>changes and then create a new partition - a new MBR is created. A boot
>sector virus should not survive this action.
>
> I seem to remember that I did just that about 8 years ago to remove a boot
> sector virus from a friends computer.
>
> But then, it was 8 years ago! (-:
>
> --
>
> Richard Urban
> Microsoft MVP
> Windows Desktop Experience
>
>
> "FromTheRafters" <erratic@ne.rr.com> wrote in message
> news:eidn5OmAJHA.4256@TK2MSFTNGP05.phx.gbl...
>> If your OS has been severely compromised, you don't want to
>> use the copy of format.com that is on that machine to do the
>> format. In the old days, the "rootkit" was a collection of utilities
>> and tools that were modified from their original to something
>> perhaps nefarious. If someone had root access they could
>> replace the formatting tool with one that only appears to format
>> the drive. As long as the act of formatting and reinstalling touches
>> the boot axis areas of the disk then any trace of malware should
>> be overwritten or no longer linked to.
>>
>> There is some malware (I forget the name(s)) that affect the boot
>> areas of the disk, and IIRC simple format won't affect that area.
>> You probably are just left with an unbootable drive unless the
>> area is repaired.
>>
>> "Steve Riley [MSFT]" <steve.riley@microsoft.com> wrote in message
>> news:29FE1A85-1B8E-45DB-AFFD-D1638829676A@microsoft.com...
>>>A simple format and reinstall is sufficient to have a fresh clean copy of
>>>the OS without malware.
>>>
>>> Multi-pass wipes aren't necessary unless you want to ensure there's
>>> nothing remaining when you sell or give away the drive.
>>>
>>> --
>>> Steve Riley
>>> steve.riley@microsoft.com
>>> http://blogs.technet.com/steriley
>>> http://www.protectyourwindowsnetwork.com
>>>
>>>
>>>
>>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>>> news:811439D9-10B5-43EE-9BEA-0DB3C1B8FA2B@microsoft.com...
>>>> Thank you. For instance, a DOD wipe is done before a clean
>>>> installation for
>>>> better safety and security. I would imagine, the only true safety on a
>>>> drive
>>>> is to perform this and then totally annihilate the hard drive if it
>>>> contains
>>>> classified and/or sensitive information.
>>>>
>>>> "FromTheRafters" wrote:
>>>>
>>>>> Wipe is "cleaner" than format, and reload is dependent on
>>>>> exactly what is reloaded.
>>>>>
>>>>> "Dan" <Dan@discussions.microsoft.com> wrote in message
>>>>> news:A0D7B739-8E6B-4389-B239-F3F35DECB4F1@microsoft.com...
>>>>> > Steve and Robear, I was wondering if that was as clean as a format
>>>>> > and
>>>>> > clean
>>>>> > install or is my wording just different and means the same thing.
>>>>> > <?>
>>>>> >
>>>>> > "PA Bear [MS MVP]" wrote:
>>>>> >
>>>>> >> 9 times out of 10, we end up ripping them out by the roots...or
>>>>> >> doing a
>>>>> >> "wipe & reload."
>>>>> >> --
>>>>> >> ~Robear Dyer (PA Bear)
>>>>> >> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002
>>>>> >> AumHa VSOP & Admin http://aumha.net
>>>>> >> DTS-L http://dts-l.net/
>>>>> >>
>>>>> >> Spin wrote:
>>>>> >> > I know Symantec offers RootKit detection tools, as does Panda
>>>>> >> > Security,
>>>>> >> > F-Secure, to name a few. However, this is addressed to those of
>>>>> >> > you in
>>>>> >> > this
>>>>> >> > newsgroup, which of those do you prefer to use "out in the
>>>>> >> > field"?
>>>>> >>
>>>>> >>
>>>>>
>>>>>
>>>>>
>>
>>
>