🚀 go-pugleaf

  To: alt.comp.virus,alt.comp.a
On 8/1/2010 8:24 AM, Dustin wrote:
> John Slade<hhitman86@pacbell.net>  wrote in
> news:i32s10$653$1@news.eternal-september.org:
>
>> On 7/31/2010 4:21 PM, Dustin wrote:
>>> John Slade<hhitman86@pacbell.net>   wrote in
>>> news:L0p4o.32466$OU6.4877@newsfe20.iad:
>>>
>>>> On 7/29/2010 1:40 PM, David H. Lipman wrote:
>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>
>>>>> | On 7/29/2010 3:24 AM, David H. Lipman wrote:
>>>>>>> From: "John Slade"<hhitman86@pacbell.net>
>>>>>
>>>>>>> | On 7/27/2010 11:17 PM, RJK wrote:
>>>>>
>>
>>>
>>>>          You should know there is malware out there that will
>>>> trash the registry and it's backup. It will require some sort of
>>>> reinstall to get the system back working. I found it very rare
>>>> that I need to do a full reformat and reinstall because of
>>>> malware. Some malware will also corrupt system files and when
>>>> you remove them with scanners, it will make the installation
>>>> unbootable. This is yet another reason professionals will make a
>>>> backup if possible before removing infections.
>>>
>>> What software do you use for the backup?
>>
>>        I will either use Acronis' or Paragon's backup software
>> depending on the situation.
>>
>>> Are you storing the backup on
>>> read only media or a hard drive that could fail for any reason?
>>
>>       You mean WORM(Write Once/Read Many) media don't you? That
>> media can fail also. No media is perfect. I store the backup on
>> business or enterprise grade HDs and will transfer to other
>> media if the customer wants that backup. If it's a large backup
>> they will have to pay me for it. Tell me what software and
>> hardware would you use to backup your customer's HD before you
>> start removing malware?
>
> I haven't heard the acronym WORM in years... Damn, you have been around
> a long time. :) I was thinking of cd-r or perhaps dvd-r material.

       It would be OK for DVD-R if the backup is small. But 
swapping 20 or more DVDs is a pain.

>
> It depends. When I was working at a computer shop; I'd either use
> norton ghost corp edition or the hardware drive cloning device we had
> at the time.

       I rarely use Ghost these days, it used to be the only 
thing I ever used.


> I really didn't see much point in cloning a malware drive
> for malware removal; I wasn't stupid enough to trash my backups of the
> registry or important files. besides, I wrote several utilities to
> assist me in verifying various windows dll/exe files were still intact
> and okay for reuse.
>

      Yea that's good for you, but when you're working for 
someone else and they have important data they want to save, I 
will backup. Most of the time the customer doesn't have a 
backup. A lot of times the customer has a HD that's five or six 
years old and they really need a backup done. Then there are the 
times when I'm working for a young person and they don't want a 
backup they just want the drive wiped and they want the OS 
installed.

> We would typically reserve cloning drives for hardware failure signs.
> Although, a customer could have us clone a drive for a malware issue if
> they so desired. By default, we always copied docs, favorites, emails
> etc before doing anything... But, you know, different places have
> different policies.

     I work mostly with home users and small businesses and a 
lot of times they have personal stuff they want to save. So I'll 
do a quick backup of that data and then I'll do the full backup. 
Sometimes they just want a reinstall. There are times when they 
tell me not to backup because the data isn't important. In 
David's response he seems worried about saving data so I 
wondered why he wouldn't backup.

>
> Why do you spend the additional time to clone an entire drive for a
> malware removal job?

     It doesn't take that long most of the time and it's a lot 
safer for the user's data. In most cases it actually takes 
longer to install, upgrade and reinstall software for the 
customer. Most of the time I backup less than 150GB.

>
>>>
>>>>         I know there are a lot of fly-by-night computer repair
>>>> people who are just there to do a quick fix and get paid, I find
>>>> myself cleaning up after a lot of them.
>>>
>>> I've encountered a few of those in my time as well.... I enjoy the
>>> work they provide me tho.
>>
>>        Me too. I especially get a kick out of the ones who don't
>> do backups and leave various screws out.
>
> Or, use the wrong screws and strip one of the drives :)
>
>>> Tell me something, John, as a PROFESSIONAL, have
>>> you written any of the tools you use for cleanup; or do you use the
>>> work others have written, such as myself, David lipman and many
>>> others?
>>>
>>
>>        For the record, I'm not trying to get into some pissing
>> contest. I was just making a suggestion as to how to fix the
>> problem laid out in the OP.
>
> I understand. It just seemed as if you were being a wiseass towards
> David, from my POV. I didn't personally see any need in doing that. We
> can all be professional and civil here.

     David was being a wiseass himself and I can understand why 
he didn't respond. He seemed worried about losing data by simply 
removing the system restore points so I naturally wondered why, 
a backup can solve this problem. I guess he realized it was a 
good idea so then he got snippy.

>
>>         I use software others have written. I'm not a software
>> engineer. I'm a professional computer repair person. I find that
>> competence in one profession such as software engineering
>> doesn't translate into something else like tech support. I've
>> been repairing computers for close to 25 years and have learned
>> a lot. One thing I've learned is a backup saves a lot of trouble
>> and allows for different approaches to be tried.
>
> Well, a backup is a good way of having an escape route should something
> go wrong. :) From a software aspect tho, I haven't really encountered
> much malware that would justify the time I spent on imaging the drive
> first. I wasn't in charge of billing tho, so that may have played a
> part in that.

     I don't work for any company I work freelance. Like I said 
most backups are small and usually take from 20 minutes to a 
couple of hours. I don't charge by the hour I charge by the job.

>
>>         So tell me what products have you and David Lipman
>> written and where can I check them out?
>
> I've written all kinds of old utility style apps, as you've been around
> so long you might know a few of them.. Cmoscon, encode, delock, and
> various others. If your into crypto/security, you might even know the
> old dos file/freespace wiping app called NuKE and/or possibly CryptX.
>

     I've heard of some of those.

> In more recent times, I developed an antimalware scanner (that's why I
> found your description on how they worked amusing. hehehe) called
> BugHunter. I did a stint as a malware researcher for an app called
> Malwarebytes antimalware..
>

          I don't know why you would find it funny because a 
virus writer will use anything to hide a virus. What smarter way 
is to hide them in each and every folder in "system volume 
information"? I do believe that what the system had was a 
variant of the Virtumonde trojan. If you did research on malware 
then you know virus writers will take existing malware and 
modify it. I found one thing to be true in the world of malware, 
NOBODY knows everything about every malware variant out there. 
You can believe me or not, it doesn't matter.

John

---
 * Synchronet * The Whitehouse BBS --- whitehouse.hulds.com --- check it out free usenet!
--- Synchronet 3.15a-Win32 NewsLink 1.92
Time Warp of the Future BBS - telnet://time.synchro.net:24