Post by John SladePost by DustinPost by John SladePost by DustinPost by John SladePost by DustinPost by John SladePost by DustinPost by John SladeYou should know there is malware out there that will
trash the registry and it's backup. It will require some
sort of reinstall to get the system back working. I found it
very rare that I need to do a full reformat and reinstall
because of malware. Some malware will also corrupt system
files and when you remove them with scanners, it will make
the installation unbootable. This is yet another reason
professionals will make a backup if possible before removing
infections.
What software do you use for the backup?
I will either use Acronis' or Paragon's backup
software
depending on the situation.
Post by DustinAre you storing the backup on
read only media or a hard drive that could fail for any
reason?
You mean WORM(Write Once/Read Many) media don't you? That
media can fail also. No media is perfect. I store the backup
on business or enterprise grade HDs and will transfer to other
media if the customer wants that backup. If it's a large
backup they will have to pay me for it. Tell me what software
and hardware would you use to backup your customer's HD before
you start removing malware?
I haven't heard the acronym WORM in years... Damn, you have
been around a long time. :) I was thinking of cd-r or perhaps
dvd-r material.
It would be OK for DVD-R if the backup is small. But
swapping 20 or more DVDs is a pain.
Post by DustinIt depends. When I was working at a computer shop; I'd either
use norton ghost corp edition or the hardware drive cloning
device we had at the time.
I rarely use Ghost these days, it used to be the only
thing I ever used.
Post by DustinI really didn't see much point in cloning a malware drive
for malware removal; I wasn't stupid enough to trash my backups
of the registry or important files. besides, I wrote several
utilities to assist me in verifying various windows dll/exe
files were still intact and okay for reuse.
Yea that's good for you, but when you're working for
someone else and they have important data they want to save, I
will backup. Most of the time the customer doesn't have a
backup. A lot of times the customer has a HD that's five or six
years old and they really need a backup done. Then there are the
times when I'm working for a young person and they don't want a
backup they just want the drive wiped and they want the OS
installed.
Theres your odd attitude again. What makes you think I wasn't
working for someone else when I did those things? Obviously since
I didn't own the shop, I was working for someone else.
Well you made it sound like you were doing it for
yourself.
Post by DustinBtw, What certifications do you presently hold? I'm just lowly
A+/network+ (back when that stupid thing was still considered
worth the paper it's printed on). Are you MCSE?
I took courses and wound up teaching an A+ class. A+ is a
good place to start for someone looking to get certified for
work at some company that requires that cert. I view the MCSE
certification as pretty much a money making scam. I look at MCSE
certifications as a joke in many cases because some courses just
My boss paid for the tests, it just cost me some driving time. As
I've been doing the computer thing since the trash80 series was
actually new and hot stuff to some, I didn't really need to study
for the exam. While tandy's computers were proprietary in nature,
they had some things in common with cp/m and later dos machines.
Besides, it beat tracing a grounding problem on an AT mainboard
keyboard port.<G>
The shop I worked at actually fixed problems, we didn't ship to
manufacturer or sell you a new mainboard if components could be
replaced cheaper and still bring the system back to it's original
self. None of us were afraid of soldering pencils or precision
electronics, everyone at the shop had a background in it.
I got my start in electronics and have a background in
that too. I took college courses in electronics and am no
stranger to repairing circuit boards. I'm no stranger to
soldering irons. Well that's what we called them. I used to
repair TVs, radios and such years ago.
Odd. I'm familiar with soldering irons as well as pencils, and we
typically use the pencils for detail work that the iron generates too
much heat for. Irons aren't good for changing out small transistors,
IC's or caps due to the risk of damage, and especially these days with
a pile of components nearby the one that has to be replaced; a pencil
is the only way to safely do it. Lower wattage, less heat.
I got my start outside of my house reparing neighborhood tvs, vcrs,
etc; but I was something like 9 or 10 years old doing that stuff. I
enjoyed it, and I didn't burn anything up that wasn't mine.
Post by John SladePost by DustinSo, as a professional with years on me, do you replace boards or
actually get down and dirty with them?
When I need to repair a blown component like a bad sound
card, video card or controller card, I replace it. I haven't
needed to repair an actual circuit board for at least 15 years.
So you haven't seen the leaking capacitor issue in your time
professionally repairing PCs? If you have, did you upsell your client
instead of replacing the caps? You can find them pretty cheap, in 50-
100 packs; enough to do several boards...
Post by John SladeThe last component level repairs I did for a computer was
replacing burned out components on my old Amiga computer's
motherboard. But I gave up on all that stuff, just not worth the
hassle any more especially with these newer multilayer boards
with tiny components and surface mounted chips. It can be done
but it's usually not worth it.
You don't work with laptops much eh? They're bad about breaking the
power connector on the mainboard. In those cases, what do you do?
Post by John SladePost by DustinIt looks nice on paper, tho. :) I like you didn't bother to fork
out the 2grand for the MCSE certs, I watched a friend of mine who
knew next to nothing about computers; get MCSE inside of 3 months
time. So, yea, I'm in complete agreement with you about them. Lots
of reading, a very small amount of practice in the LAN I configured
for him, and walla; MCSE certified; but doesn't know his ass from a
hole in the ground.
MCSE is pretty useless in my current repair field.
However it's good to learn if you take a proper course such as a
computer science course at a college. I took a three-month MSCE
course and found I had already learned most of the stuff on my own.
I see no reason to take a college course for material I already know
likely better than the instructor. Nothing beats hands on real world
experience.
Post by John SladePost by DustinI know of no malware which would force me to toss an entire restore
point. I can just go into the folder from another system and do
what needs to be done; without endangering said system.
I used Bitdefender's bootable CD to remove malware from the
restore point files and it did not solve the problem. I rebooted
and the malware was written there again. Only when I turned off
If the malware was written back when you rebooted, you missed something
that was being given a chance to run when windows was booted normally.
Post by John Sladesystem restore and when I rebooted, I got a popup stating that
it couldn't find a file in the system restore folders that were
deleted. Then I did a final scan and the malware was gone,
system fixed.
Again, thats on you for missing the file in the first place... Nobody
said you couldn't store a file in the system restore folder, in fact
you can. Seriously, professional to professional, you should have done
a more thorough check when you booted from a clean disc; and I don't
mean a bootable scanner disc, I mean a clean disc work environment: In
the future, I suggest you give a BartPE disc a try. It's like being in
windows, on cd. You can use console functions if your comfortable (I'm
home in console myself) or windows explorer style. Either way, it gives
you a full view of the contents of the hard disk; and you can come/go
to the system restore folder as you please, no protections preventing
you access will you find.
A file sitting in the root of system restore should NOT ever be
overlooked by a professional. you should notice something like that,
you should be looking for something like that just as you would random
named dlls present in the windows\system32 folder.
I'm not trying to talk down to you or anything like that, so don't
misunderstand me. Alright? I'm just stating some tips for you for
future work with malware.
Post by John SladePost by DustinHmm. I'm guessing you don't know how the restore functions in
windows actually works. I'll clue you in.. If I so much as edit a
sys/dll/com/exe file in the windows folders a restore point is
automatically created so long as system restore is turned on. That
restore point will backup the file before my changes are finalized
on disk. Unless, I override system restore and do it directly.
I know how system restore works and I'm 100% sure it can
be exploited by malware writers.
Lemme rephrase myself, I understand how system restore works from the
end user Point of view; which would include yourself as your not a
programmer... And that of the programmer point of view. the way I
explained system restore is how it works behind the screen. What you
don't see as you don't read code, ok?
And what I described is indeed one way to exploit system restore to
your own advantage, by forcing it to do exactly what it's designed to
do. However, you can't claim the system restore folder itself is
infected if a binary file is placed there with a hidden/system
attribute set and you miss it when you boot clean. The folder itself
still isn't infected. It's no different than leaving the binary in the
\windows folder and setting the runkey to it, vs the system restore
folder. The only advantage the malware has by residing in system
restore instead is that windows by default will protect it somewhat
from users trying to mess with that folder contents under normal
conditions. That is the ONLY advantage you get as a malware executable
choosing that location over another; The OS will make some effort to
protect you as a side effect of keeping users from getting themselves
in trouble.
System restore has been well documented and all exploit avenues have
been fully covered in all kinds of various worms, viruses and trojans
at some point or another. Again, the only advantage you have from the
virus point of view is os protection from the user touching you via
normal methods. That doesn't mean you've infected system restore,
you're just abusing windows a little bit.
Post by John SladePost by DustinI don't suppose you kept a sample for analysis?
No. I just clean them I don't study them. I do this sort
of thing a lot and don't really keep track of each piece of
malware I remove. I remove scores and hundreds of trojans and
worms from systems. I probably still have the scan log though if
I find it I'll post it here. This was more than a year ago when
I removed it.
I see..
--
"I like your Christ. I don't like your Christians. They are so unlike
your Christ." - author unknown.