🚀 go-pugleaf

John Slade <hhitman86@pacbell.net> wrote in
news:i37va2$e0f$1@news.eternal-september.org: 

> On 8/2/2010 11:41 AM, Dustin wrote:
>> John Slade<hhitman86@pacbell.net>  wrote in
>> news:3dp5o.33911$o27.791@newsfe08.iad:
>>
>>> On 8/1/2010 3:04 PM, Dustin wrote:
>>>> John Slade<hhitman86@pacbell.net>   wrote in
>>>> news:ILj5o.44119$4B7.2363@newsfe16.iad:
>>>>
>>>>> On 8/1/2010 8:24 AM, Dustin wrote:
>>>>>> John Slade<hhitman86@pacbell.net>    wrote in
>>>>>> news:i32s10$653$1@news.eternal-september.org:
>>>>>>
>>>>>>> On 7/31/2010 4:21 PM, Dustin wrote:
>>>>>>>> John Slade<hhitman86@pacbell.net>     wrote in
>>>>>>>> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>>>>>>>>
>>>>>>>>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>
>>>>>>>>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>>>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>>>>>>
>>>>>>>>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>>>>>>>>
>>>>>>>
>>>>>>>>
>>>>>>>>>            You should know there is malware out there that
>>>>>>>>>            will 
>>>>>>>>> trash the registry and it's backup. It will require some
>>>>>>>>> sort of reinstall to get the system back working. I found it
>>>>>>>>> very rare that I need to do a full reformat and reinstall
>>>>>>>>> because of malware. Some malware will also corrupt system
>>>>>>>>> files and when you remove them with scanners, it will make
>>>>>>>>> the installation unbootable. This is yet another reason
>>>>>>>>> professionals will make a backup if possible before removing
>>>>>>>>> infections.
>>>>>>>>
>>>>>>>> What software do you use for the backup?
>>>>>>>
>>>>>>>          I will either use Acronis' or Paragon's backup
>>>>>>>          software 
>>>>>>> depending on the situation.
>>>>>>>
>>>>>>>> Are you storing the backup on
>>>>>>>> read only media or a hard drive that could fail for any
>>>>>>>> reason? 
>>>>>>>
>>>>>>>         You mean WORM(Write Once/Read Many) media don't you?
>>>>>>>         That 
>>>>>>> media can fail also. No media is perfect. I store the backup
>>>>>>> on business or enterprise grade HDs and will transfer to other
>>>>>>> media if the customer wants that backup. If it's a large
>>>>>>> backup they will have to pay me for it. Tell me what software
>>>>>>> and hardware would you use to backup your customer's HD before
>>>>>>> you start removing malware?
>>>>>>
>>>>>> I haven't heard the acronym WORM in years... Damn, you have
>>>>>> been around a long time. :) I was thinking of cd-r or perhaps
>>>>>> dvd-r material.
>>>>>
>>>>>          It would be OK for DVD-R if the backup is small. But
>>>>> swapping 20 or more DVDs is a pain.
>>>>>
>>>>>>
>>>>>> It depends. When I was working at a computer shop; I'd either
>>>>>> use norton ghost corp edition or the hardware drive cloning
>>>>>> device we had at the time.
>>>>>
>>>>>          I rarely use Ghost these days, it used to be the only
>>>>> thing I ever used.
>>>>>
>>>>>
>>>>>> I really didn't see much point in cloning a malware drive
>>>>>> for malware removal; I wasn't stupid enough to trash my backups
>>>>>> of the registry or important files. besides, I wrote several
>>>>>> utilities to assist me in verifying various windows dll/exe
>>>>>> files were still intact and okay for reuse.
>>>>>>
>>>>>
>>>>>         Yea that's good for you, but when you're working for
>>>>> someone else and they have important data they want to save, I
>>>>> will backup. Most of the time the customer doesn't have a
>>>>> backup. A lot of times the customer has a HD that's five or six
>>>>> years old and they really need a backup done. Then there are the
>>>>> times when I'm working for a young person and they don't want a
>>>>> backup they just want the drive wiped and they want the OS
>>>>> installed.
>>>>
>>>> Theres your odd attitude again. What makes you think I wasn't
>>>> working for someone else when I did those things? Obviously since
>>>> I didn't own the shop, I was working for someone else.
>>>
>>>         Well you made it sound like you were doing it for
>>>         yourself. 
>>>
>>>>
>>>> Btw, What certifications do you presently hold? I'm just lowly
>>>> A+/network+ (back when that stupid thing was still considered
>>>> worth the paper it's printed on). Are you MCSE?
>>>>
>>>
>>>         I took courses and wound up teaching an A+ class. A+ is a
>>> good place to start for someone looking to get certified for
>>> work at some company that requires that cert. I view the MCSE
>>> certification as pretty much a money making scam. I look at MCSE
>>> certifications as a joke in many cases because some courses just
>>
>> My boss paid for the tests, it just cost me some driving time. As
>> I've been doing the computer thing since the trash80 series was
>> actually new and hot stuff to some, I didn't really need to study
>> for the exam. While tandy's computers were proprietary in nature,
>> they had some things in common with cp/m and later dos machines.
>> Besides, it beat tracing a grounding problem on an AT mainboard
>> keyboard port.<G> 
>>
>> The shop I worked at actually fixed problems, we didn't ship to
>> manufacturer or sell you a new mainboard if components could be
>> replaced cheaper and still bring the system back to it's original
>> self. None of us were afraid of soldering pencils or precision
>> electronics, everyone at the shop had a background in it.
> 
>       I got my start in electronics and have a background in 
> that too. I took college courses in electronics and am no 
> stranger to repairing circuit boards. I'm no stranger to 
> soldering irons. Well that's what we called them. I used to 
> repair TVs, radios and such years ago.

Odd. I'm familiar with soldering irons as well as pencils, and we 
typically use the pencils for detail work that the iron generates too 
much heat for. Irons aren't good for changing out small transistors, 
IC's or caps due to the risk of damage, and especially these days with 
a pile of components nearby the one that has to be replaced; a pencil 
is the only way to safely do it. Lower wattage, less heat. 

I got my start outside of my house reparing neighborhood tvs, vcrs, 
etc; but I was something like 9 or 10 years old doing that stuff. I 
enjoyed it, and I didn't burn anything up that wasn't mine.

>>
>> So, as a professional with years on me, do you replace boards or
>> actually get down and dirty with them?
> 
>     When I need to repair a blown component like a bad sound 
> card, video card or controller card, I replace it. I haven't 
> needed to repair an actual circuit board for at least 15 years. 

So you haven't seen the leaking capacitor issue in your time 
professionally repairing PCs? If you have, did you upsell your client 
instead of replacing the caps? You can find them pretty cheap, in 50-
100 packs; enough to do several boards...

> The last component level repairs I did for a computer was 
> replacing burned out components on my old Amiga computer's 
> motherboard. But I gave up on all that stuff, just not worth the 
> hassle any more especially with these newer multilayer boards 
> with tiny components and surface mounted chips. It can be done 
> but it's usually not worth it.

You don't work with laptops much eh? They're bad about breaking the 
power connector on the mainboard. In those cases, what do you do?
 
>> It looks nice on paper, tho. :) I like you didn't bother to fork
>> out the 2grand for the MCSE certs, I watched a friend of mine who
>> knew next to nothing about computers; get MCSE inside of 3 months
>> time. So, yea, I'm in complete agreement with you about them. Lots
>> of reading, a very small amount of practice in the LAN I configured
>> for him, and walla; MCSE certified; but doesn't know his ass from a
>> hole in the ground. 
>>
> 
>        MCSE is pretty useless in my current repair field. 
> However it's good to learn if you take a proper course such as a 
> computer science course at a college. I took a three-month MSCE 
> course and found I had already learned most of the stuff on my own.

I see no reason to take a college course for material I already know 
likely better than the instructor. Nothing beats hands on real world 
experience.
 
>> I know of no malware which would force me to toss an entire restore
>> point. I can just go into the folder from another system and do
>> what needs to be done; without endangering said system.
>>
> 
>      I used Bitdefender's bootable CD to remove malware from the 
> restore point files and it did not solve the problem. I rebooted 
> and the malware was written there again. Only when I turned off 

If the malware was written back when you rebooted, you missed something 
that was being given a chance to run when windows was booted normally.

> system restore and when I rebooted, I got a popup stating that 
> it couldn't find a file in the system restore folders that were 
> deleted. Then I did a final scan and the malware was gone, 
> system fixed.

Again, thats on you for missing the file in the first place... Nobody 
said you couldn't store a file in the system restore folder, in fact 
you can. Seriously, professional to professional, you should have done 
a more thorough check when you booted from a clean disc; and I don't 
mean a bootable scanner disc, I mean a clean disc work environment: In 
the future, I suggest you give a BartPE disc a try. It's like being in 
windows, on cd. You can use console functions if your comfortable (I'm 
home in console myself) or windows explorer style. Either way, it gives 
you a full view of the contents of the hard disk; and you can come/go 
to the system restore folder as you please, no protections preventing 
you access will you find.

A file sitting in the root of system restore should NOT ever be 
overlooked by a professional. you should notice something like that, 
you should be looking for something like that just as you would random 
named dlls present in the windows\system32 folder.

I'm not trying to talk down to you or anything like that, so don't 
misunderstand me. Alright? I'm just stating some tips for you for 
future work with malware.

>> Hmm. I'm guessing you don't know how the restore functions in
>> windows actually works. I'll clue you in.. If I so much as edit a
>> sys/dll/com/exe file in the windows folders a restore point is
>> automatically created so long as system restore is turned on. That
>> restore point will backup the file before my changes are finalized
>> on disk. Unless, I override system restore and do it directly.
> 
>        I know how system restore works and I'm 100% sure it can 
> be exploited by malware writers.

Lemme rephrase myself, I understand how system restore works from the 
end user Point of view; which would include yourself as your not a 
programmer... And that of the programmer point of view. the way I 
explained system restore is how it works behind the screen. What you 
don't see as you don't read code, ok?

And what I described is indeed one way to exploit system restore to 
your own advantage, by forcing it to do exactly what it's designed to 
do. However, you can't claim the system restore folder itself is 
infected if a binary file is placed there with a hidden/system 
attribute set and you miss it when you boot clean.  The folder itself 
still isn't infected. It's no different than leaving the binary in the 
\windows folder and setting the runkey to it, vs the system restore 
folder. The only advantage the malware has by residing in system 
restore instead is that windows by default will protect it somewhat 
from users trying to mess with that folder contents under normal 
conditions. That is the ONLY advantage you get as a malware executable 
choosing that location over another; The OS will make some effort to 
protect you as a side effect of keeping users from getting themselves 
in trouble.

System restore has been well documented and all exploit avenues have 
been fully covered in all kinds of various worms, viruses and trojans 
at some point or another. Again, the only advantage you have from the 
virus point of view is os protection from the user touching you via 
normal methods. That doesn't mean you've infected system restore, 
you're just abusing windows a little bit.
 
>> I don't suppose you kept a sample for analysis?
> 
>       No. I just clean them I don't study them. I do this sort 
> of thing a lot and don't really keep track of each piece of 
> malware I remove. I remove scores and hundreds of trojans and 
> worms from systems. I probably still have the scan log though if 
> I find it I'll post it here. This was more than a year ago when 
> I removed it.

I see..


-- 
"I like your Christ. I don't like your Christians. They are so unlike 
your Christ."  - author unknown.