🚀 go-pugleaf

On 8/2/2010 11:41 AM, Dustin wrote:
> John Slade<hhitman86@pacbell.net>  wrote in
> news:3dp5o.33911$o27.791@newsfe08.iad:
>
>> On 8/1/2010 3:04 PM, Dustin wrote:
>>> John Slade<hhitman86@pacbell.net>   wrote in
>>> news:ILj5o.44119$4B7.2363@newsfe16.iad:
>>>
>>>> On 8/1/2010 8:24 AM, Dustin wrote:
>>>>> John Slade<hhitman86@pacbell.net>    wrote in
>>>>> news:i32s10$653$1@news.eternal-september.org:
>>>>>
>>>>>> On 7/31/2010 4:21 PM, Dustin wrote:
>>>>>>> John Slade<hhitman86@pacbell.net>     wrote in
>>>>>>> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>>>>>>>
>>>>>>>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>
>>>>>>>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>
>>>>>>>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>>>>>>>
>>>>>>
>>>>>>>
>>>>>>>>            You should know there is malware out there that will
>>>>>>>> trash the registry and it's backup. It will require some sort
>>>>>>>> of reinstall to get the system back working. I found it very
>>>>>>>> rare that I need to do a full reformat and reinstall because
>>>>>>>> of malware. Some malware will also corrupt system files and
>>>>>>>> when you remove them with scanners, it will make the
>>>>>>>> installation unbootable. This is yet another reason
>>>>>>>> professionals will make a backup if possible before removing
>>>>>>>> infections.
>>>>>>>
>>>>>>> What software do you use for the backup?
>>>>>>
>>>>>>          I will either use Acronis' or Paragon's backup software
>>>>>> depending on the situation.
>>>>>>
>>>>>>> Are you storing the backup on
>>>>>>> read only media or a hard drive that could fail for any reason?
>>>>>>
>>>>>>         You mean WORM(Write Once/Read Many) media don't you? That
>>>>>> media can fail also. No media is perfect. I store the backup on
>>>>>> business or enterprise grade HDs and will transfer to other
>>>>>> media if the customer wants that backup. If it's a large backup
>>>>>> they will have to pay me for it. Tell me what software and
>>>>>> hardware would you use to backup your customer's HD before you
>>>>>> start removing malware?
>>>>>
>>>>> I haven't heard the acronym WORM in years... Damn, you have been
>>>>> around a long time. :) I was thinking of cd-r or perhaps dvd-r
>>>>> material.
>>>>
>>>>          It would be OK for DVD-R if the backup is small. But
>>>> swapping 20 or more DVDs is a pain.
>>>>
>>>>>
>>>>> It depends. When I was working at a computer shop; I'd either use
>>>>> norton ghost corp edition or the hardware drive cloning device we
>>>>> had at the time.
>>>>
>>>>          I rarely use Ghost these days, it used to be the only
>>>> thing I ever used.
>>>>
>>>>
>>>>> I really didn't see much point in cloning a malware drive
>>>>> for malware removal; I wasn't stupid enough to trash my backups
>>>>> of the registry or important files. besides, I wrote several
>>>>> utilities to assist me in verifying various windows dll/exe files
>>>>> were still intact and okay for reuse.
>>>>>
>>>>
>>>>         Yea that's good for you, but when you're working for
>>>> someone else and they have important data they want to save, I
>>>> will backup. Most of the time the customer doesn't have a
>>>> backup. A lot of times the customer has a HD that's five or six
>>>> years old and they really need a backup done. Then there are the
>>>> times when I'm working for a young person and they don't want a
>>>> backup they just want the drive wiped and they want the OS
>>>> installed.
>>>
>>> Theres your odd attitude again. What makes you think I wasn't
>>> working for someone else when I did those things? Obviously since I
>>> didn't own the shop, I was working for someone else.
>>
>>         Well you made it sound like you were doing it for yourself.
>>
>>>
>>> Btw, What certifications do you presently hold? I'm just lowly
>>> A+/network+ (back when that stupid thing was still considered worth
>>> the paper it's printed on). Are you MCSE?
>>>
>>
>>         I took courses and wound up teaching an A+ class. A+ is a
>> good place to start for someone looking to get certified for
>> work at some company that requires that cert. I view the MCSE
>> certification as pretty much a money making scam. I look at MCSE
>> certifications as a joke in many cases because some courses just
>
> My boss paid for the tests, it just cost me some driving time. As I've
> been doing the computer thing since the trash80 series was actually new
> and hot stuff to some, I didn't really need to study for the exam.
> While tandy's computers were proprietary in nature, they had some
> things in common with cp/m and later dos machines. Besides, it beat
> tracing a grounding problem on an AT mainboard keyboard port.<G>
>
> The shop I worked at actually fixed problems, we didn't ship to
> manufacturer or sell you a new mainboard if components could be
> replaced cheaper and still bring the system back to it's original self.
> None of us were afraid of soldering pencils or precision electronics,
> everyone at the shop had a background in it.

      I got my start in electronics and have a background in 
that too. I took college courses in electronics and am no 
stranger to repairing circuit boards. I'm no stranger to 
soldering irons. Well that's what we called them. I used to 
repair TVs, radios and such years ago.

>
> So, as a professional with years on me, do you replace boards or
> actually get down and dirty with them?

    When I need to repair a blown component like a bad sound 
card, video card or controller card, I replace it. I haven't 
needed to repair an actual circuit board for at least 15 years. 
The last component level repairs I did for a computer was 
replacing burned out components on my old Amiga computer's 
motherboard. But I gave up on all that stuff, just not worth the 
hassle any more especially with these newer multilayer boards 
with tiny components and surface mounted chips. It can be done 
but it's usually not worth it.

>
>> "certified" people don't know a lot. Well they do know how to
>> pass that test!
>
> I would tend to agree with that statement, based on the future
> technicians who will eventually be replacing me. :)
>
>>        I don't need any of those certifications, it's a waste of
>> money.
>
> It looks nice on paper, tho. :) I like you didn't bother to fork out
> the 2grand for the MCSE certs, I watched a friend of mine who knew next
> to nothing about computers; get MCSE inside of 3 months time. So, yea,
> I'm in complete agreement with you about them. Lots of reading, a very
> small amount of practice in the LAN I configured for him, and walla;
> MCSE certified; but doesn't know his ass from a hole in the ground.
>

       MCSE is pretty useless in my current repair field. 
However it's good to learn if you take a proper course such as a 
computer science course at a college. I took a three-month MSCE 
course and found I had already learned most of the stuff on my own.


>>> I'm just wondering what you mean by safer for the users data then I
>>> guess. If it's a malware issue, the users data itself shouldn't be
>>> affected much if at all; it's the applications and little.. extras
>>> that may be of concern.
>>
>>         It's not JUST the malware issue, I already explained that
>> often HDs I work on are pretty old. Also when you start cleaning
>> files the system may not boot, data may be destroyed. There are
>> lots of reasons to backup and that's what I learned over the years.
>
> True, plenty of reasons to backup and I certainly don't disagree with
> one who is strict with a decent backup policy; I just don't really see
> the need to do it for a malware removal job alone.
>
>>>
>>>>> I understand. It just seemed as if you were being a wiseass
>>>>> towards David, from my POV. I didn't personally see any need in
>>>>> doing that. We can all be professional and civil here.
>>>>
>>>>        David was being a wiseass himself and I can understand why
>>>> he didn't respond. He seemed worried about losing data by simply
>>>> removing the system restore points so I naturally wondered why,
>>>> a backup can solve this problem. I guess he realized it was a
>>>> good idea so then he got snippy.
>>>
>>> Well, along with potentially good dlls you might want to use to
>>> avoid having to reinstall; comes several stages of the systems
>>> registry hives. All valuable if your into recovering the system, as
>>> opposed to wiping and starting over. I see no reason to obliterate
>>> the restore points right away; They still contain potentially
>>> useful data to me.
>>>
>>
>>         You may or may not have to delete restore points. It
>> depends on the particular malware.
>
> I know of no malware which would force me to toss an entire restore
> point. I can just go into the folder from another system and do what
> needs to be done; without endangering said system.
>

     I used Bitdefender's bootable CD to remove malware from the 
restore point files and it did not solve the problem. I rebooted 
and the malware was written there again. Only when I turned off 
system restore and when I rebooted, I got a popup stating that 
it couldn't find a file in the system restore folders that were 
deleted. Then I did a final scan and the malware was gone, 
system fixed.

>>> What seperates some professionals from others is the ability to
>>> restore the system without resorting to wiping and reloading as
>>> really, anybody could do that. In many cases, not all, but many,
>>> you don't have to wipe and reload the entire system to get rid of
>>> the malware.
>>
>>       Yea that's why I find making a backup allows me to make a
>> mistake if removing the malware causes the installation to be
>> trashed and it does happen.
>
> Be careful and take your time. Safety first and all that. :)
>
>>> Well, I found it funny from the point of view of a former virus
>>> writer turned whitehat. Does that make any sense to you?
>>
>>>
>>> Why would I spend the time to hide a virus in a folder, when I
>>> could choose files? You could just delete me if I stored myself in
>>> a folder in a binary format alone. If I reside in your files
>>> instead, I'm alot harder to deal with.
>>
>>         Well you could chose particular files in the restore
>> point folders, you could tell it to create a restore point and
>> infect the system files. The advantage is the malware scanner
>> will not clean it because it's a read only folder by default.
>
> Hmm. I'm guessing you don't know how the restore functions in windows
> actually works. I'll clue you in.. If I so much as edit a
> sys/dll/com/exe file in the windows folders a restore point is
> automatically created so long as system restore is turned on. That
> restore point will backup the file before my changes are finalized on
> disk. Unless, I override system restore and do it directly.

       I know how system restore works and I'm 100% sure it can 
be exploited by malware writers.

>>>
>>> It's entirely possible the individual does have a virut varient, I
>>> haven't seen the sample to confirm or deny that. Based only on what
>>> Ant has written up about it tho, doesn't seem to indicate virut;
>>> but something possibly forked from the same original codebase.
>>>
>>
>>         All I remember is that the many restore points were all
>> infected with the same malware. Restore points that were there
>> before the malware was installed by the user. The malware was in
>> some pirated software that was installed a couple of days before
>> I was called.
>
> I don't suppose you kept a sample for analysis?

      No. I just clean them I don't study them. I do this sort 
of thing a lot and don't really keep track of each piece of 
malware I remove. I remove scores and hundreds of trojans and 
worms from systems. I probably still have the scan log though if 
I find it I'll post it here. This was more than a year ago when 
I removed it.

John