On Sun, 12 Aug 2007 09:58:03 -0700, MrSlartybartfast
>Yes, creating an image of a hard drive which has malware would include the
>malware in the image. When copying this image back to the hard drive, the
>malware would also be copied back resulting in net gain of zero.
This is why "just backup!" (as glibly stated) is as useless as "just don't get viruses!" or "if you get infected, clean the virus!" etc.
All of these approaches work, but have complexity within them that make for YMMV results. The complexity is similar across all three contexts; how one scopes out the bad guys. The mechanics of meeting that inescapable challenge vary between the three "solutions".
>When I reinstall Windows, I reinstall off the original DVD which has
>no malware, unless you call Windows itself malware :)
This is using time as the great X-axis, i.e. the OS code base is as old as possible, therefore excludes the malware. And so, the PC is known to be clean.
But it also lacks every code patch needed to keep it that way, in the face of direct exploits a la Lovesan or Sasser etc. and to patch those, you'd have to expose this unpatched PC to the Internet.
It's also bereft of any applications and data. Presumably once can do the same with applications and drivers as with the OS; install known-good baseline code from CDs and then patch these online, or re-download apps and drivers from the 'net.
There's also no data, and another cruch comes here, because you probably don't want a data set that's certain to be too old to be infected; you want your most recent backup, which is the one most likely to be malware-tainted. How to scope data from malware?
Even though MS pushes "just" wipe and rebuild as the malware panacea, they undermine these poiunts of failure:
- they generally don't ship replacement code on CDs or DVDs
- they don't attempt to separate data, code and incoming material
The first has improved, what with XP SP2 being released as a CD, and with XP SP2 defaulting to firewall on.
There's little or no progess on the second, though; still no clearly visible distinction between data and code, still no type discipline so malware can sprawl across file types and spoof the user and OS into trusting these, incoming material is still hidden in mail stores and mixed with "documents" etc.
In Vista, just what is backed up and what is not is even more opaque, as there's little or no scoping by location at all.
>If the malware is on drive D:\ then it possibly could be reactivated on to
>drive C:\. You normally need to access the files on D:\ to reactivate the
>malware.
For values of "you" that includes the OS as a player. Even with a wipe-and-rebuild that ensures no registry pointers to code on D:, there can still be code autorun from D: via Desktop.ini, \Autorun.inf, or the exploitation of any internal surfaces.
Such surfaces may present themselves to the material:
- when you do nothing at all, e.g. indexers, thumbnailers etc.
- when you "list" files in "folders"
- when a file name is displayed
>No antivirus is perfect either, antivirus programs can often miss finding
>some malware. I tend to find antivirus programs clunky and annoying and
>prefer not to use them.
I use them, as I think most users do. If you "don't need" an av, then clearly you have solved the "don't get viruses" problem, and the contexts of "clean the virus" and "rebuild and restore data" don't arise. If they do arise, you were wong in thinking "don't get viruses" was solved, and maybe you should rethink "I don't need an av" (while I do agree that av will miss things).
Your nice freshly-built PC has no av, or an av installed from CD that has an update status far worse than whatever was in effect when you were infected. To update the av, you have to take this clean, unpatched, un-protected-by-av system online...
>On my D:\ I compress my files individually which makes it hard for malware
>to emerge.
That helps. It also helps in av can traverse this compression for the on-demand scans you'd want to do between rebuilding C: and installing and updating av, and doing anythiing on D: or restoring "data".
>It is a painful process and takes a few hours so I do not do this very often.
I should hope not; it's "last resort". If you have no confidence in the ability to detect or avoid malware, do you do this just when convenient, or whenever you "think you might be infected", or do you do it every X days so attackers have "only" X days in which they can harvest whatever they can grab off your PC?
>I do find this much easier than trying to live with an antivirus
>program installed. My choice is not for everyone
It might have been a best-fit in the DOS era, when "don't get viruses" was as easy as "boot C: before A: and don't run .EXE, .COM and .BAT files". By now, a single resident av poses little or no system impact, whereas the wipe-and-rebuild process is a PITA.
Frankly, doing a wipe-and-rebuild every now and then on a PC that's probably clean anyway, will increase the risks of infection.
Do the maths; you either get infected so often that the risks of falling back to unpatched code hardly makes things worse, in which case whatever you (blindly) do is equally useless, or your approach works so well that falling back to unpatched code is your single biggest risk of infection, and to improve things, you should stop doing that. If you have no ability to tell whether you are or have ever been infected, you can't distingusish between these states.
>as I said before I have no valuable information stored on
>my PC, I do not own a credit card and do not use internet
>banking. If I have malware then I can live with it.
Most of us want better results than that, and generally attain them.
Why are we reading this advice again?
>The AUMHA forum you linked to as a recommendation for Nanoscan and Totalscan
>does nothing for me, it is hardly a review. Panda Software is well known, so
>this is not one of the fake virus scans which is on the web. Out of
>curiosity I started to run it anyway, I did not continue since I do not yet
>fully understand the software and am not prepared to install the files on my
>PC. You may use this if you wish but it is not for me.
I agree with you there, especially if you suspect the PC is infected. How do you know the site you reached, is not a malware look-alike that resident malware has spoofed you to? Is it really a good idea to...
- disable resident av
- run Internet Explorer in admin mode so as to drop protection
- say "yes" to all ActiveX etc. prompts
- allow the site to drop and run code
- stay online while this code "scans" all your files
...as the advice at such sites generally suggests?
>The bots which harvest email addresses off the internet are just that, bots.
> They scour the entire internet, not just microsoft newsgroups. To be safe,
>never use your real name, never give your address, phone number or contact
>details, create temporary email accounts to use to sign up to forums and
>newsgroups,
Bots are unbounded, because:
- they can update themselves
- they facilitate unbounded interaction from external entities
Those external entities may be other bots or humans. In essence, an active bot dissolves confidence in the distinction between "this system" and "the Internet" (or more more accurately, "the infosphere", as local attacks via WiFi may also be facilitated).
No comments:
Post a Comment