Straight From The Mouth: Don't Bother

Our good pals over at The Register are reporting that a top Microsoft security official has stated on-record that it is not worth the trouble to try and repair a virus- or malware-infected system. (A related story at eWeek can be found here.)

Of course, most of us already *knew* that, but that's apparently going to be the official response to it. There simply is no good way that is also time-efficient to restore full functionality to Windows following a successful virus or malware attack.

(As an interesting side note Reg's article mentions that virus authors are now profit-motiviated, which is kinda scary, but I suppose that almost always was the point for each virus thing after the RTM worm, which was nothing more than a "Ooh, look what I can do!" type thing.)

No news here. If given the choice I'd wipe a system clean and reinstall fresh before trying to remove an infection. It's just not so easy when you have to do a custom windows install with manual driver and application installation.

Depending on the severity of the infection I'm still having some success against malware. Trend Micro's Pccillin and Webroot's Spysweeper are my best friends. Ewido and some of the custom scripts (like smitRem) being made out there are also good at removing the tougher ones.

Captain Newbie said:

(As an interesting side note Reg's article mentions that virus authors are now profit-motiviated

Click to expand...

i wouldn't be shocked if some of those virus authors actually work for mcafee.

course i wouldn't be shocked if i woke up tomorrow with my head sewn to the carpet either.

Pinky said:

No news here. If given the choice I'd wipe a system clean and reinstall fresh before trying to remove an infection. It's just not so easy when you have to do a custom windows install with manual driver and application installation.

Depending on the severity of the infection I'm still having some success against malware. Trend Micro's Pccillin and Webroot's Spysweeper are my best friends. Ewido and some of the custom scripts (like smitRem) being made out there are also good at removing the tougher ones.

Click to expand...

I run virtual using vmware and can revert to a clean snapshot if things go bad. I haven't the 'need' to revert, but I did, as a test. It worked just fine. In under 5 minutes I'm back to a clean 'install'

vmware rocks!

vmware has a free download of their vmware server (beta2) The beta has a time limit. After it is out of beta, it will still be free with no time limit. They have windows and linux versions for the host OS. The supported guest OS's (virtuals) are numerous.

All my windows servers at work are run using vmware on linux hosts and it is fantastic. We used to have rows of physical servers, now our data center has many empty racks/shelves that once housed physical servers.

ps - I'm posting this from a virtual,,,,,,,

jajmon said:

I run virtual using vmware and can revert to a clean snapshot if things go bad. I haven't the 'need' to revert, but I did, as a test. It worked just fine. In under 5 minutes I'm back to a clean 'install'

vmware rocks!

vmware has a free download of their vmware server (beta2) The beta has a time limit. After it is out of beta, it will still be free with no time limit. They have windows and linux versions for the host OS. The supported guest OS's (virtuals) are numerous.

All my windows servers at work are run using vmware on linux hosts and it is fantastic. We used to have rows of physical servers, now our data center has many empty racks/shelves that once housed physical servers.

ps - I'm posting this from a virtual,,,,,,,

Click to expand...

I've been using Ghost for years (currently doing ghost backups prior to this weekend's LAN party ). Trying to get my customers, home end-user types, to follow suite is impossible. Most of them don't even realize that when their AV subscription expires and is hounding them to renew that it actually means RENEW! lol

VMware is great stuff for small business and corporate class networking/app serving. I'm nowhere near needing that.

I don't think a blanket statement like this does any good. The current installation that my entire family uses started out life as a 98 installation. Then it was upgrade to ME then on to xp. It has been infected wih tons of spyware and malware and more than one or two viruses alomng the way. I have transfered this installation to upgraded HDDs, recovered it from multiple blue screens and made tons of hardware configuration changes including motherboard. Why does my machine still truck along like the enegizer bunny?

Granted, I do tend to catch viruses and the like in thier early stages and fix them quickly, but that is my point. You can't make a blanket statement like that. Most software issues are completely fixible.

I'm in corporate IT currently, but with a company that only "developed" an IT dept about 2 years ago, when my supervisor (the admin) and I were hired. The network upgrades and new computers we dropped in were planned and purchased through outsourcing before we were hired, so we had little control over the outcome. Supporting the end users here is a nightmare at times, because each machine is unique to the user and they rarely backup to the file server. For alot of them, the scratch folder on the file server is some means of backup, rather than their private user folder on the server. They don't understand what a "scratch directory" means (anyone in the company can alter or delete within scratch) and when a drive dies, we almost always have to send it off for recovery. Two drives died yesterday...TWO! and I have to send one off for recovery this week. The other one was alive enough to grab almost all needed files off of it as a slave, but it wouldn't boot fully because explorer.exe took a dump.

Naturally, spyware runs rampant, and I've had to format several computers over the past year and a half because of this.

I so wish to god we had set up a vmware server and a multi-terabyte array-based fileserver in the beginning....

I just have to hang on one more year, then I'm moving

Honestly I think that is to general of a statement to make. Sure some viruses completly alter your system files and even when they are deleted your system will never run the same. Though from what I have seen most viruses tend to be pretty harmless once removed, infact most the time the system will run just as well as it did before. Of course running other apps like a good defrag once it is removed is also a good idea.

=ACID RAIN= said:

The other one was alive enough to grab almost all needed files off of it as a slave, but it wouldn't boot fully because explorer.exe took a dump.

Click to expand...

Unless the motor's stopped spinning or you hear serious grinding from within the drive, I can almost always get stuff back using Ontrack's Easy Recovery. VERY good software and it might save you some of those heavy recovery service fees.

http://www.ontrack.com/easyrecoveryprofessional/