Microsoft Official: Malware Recovery Not Always Possible

FoxNews.com (Excerpt) ^ | April 4, 2006 | Rayn Naraine

[HAL9000]

Excerpt -

LAKE BUENA VISTA, Fla. — In a rare discussion on the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

~ snip ~

[NCjim]

And when did you last have to reboot UNIX? The last I recall was over the Christmas holidays when they cut the site power for maintenance.

[Hank Rearden]

My personal favorite is Window 2000 Pro as far as MS is concerned. For me and my needs it's been the most hassle-free and stable of the MS operating systems I've dealt with.

I agree; our transaction-processing terminals are Win2k Pro, and I don't think I've seen that OS crash in almost 3 years of 24/7 uptime. We've rebooted them numerous times for app-software upgrades and mods (including OS Service Packs and updates), but the OS itself just keeps humming along.

I run WinXP Pro on my office system; it's up 24/7 as well and almost as reliable as Win2k Pro.

[Looking4Truth]

2 words: "Norton Ghost" That is all...

Great program. Trouble is, back when I was doing IT consulting I'd have new clients with hosed systems that I couldn't very well do that with.

A lot of them were the type of clients who were too cheap to buy a tape backup or a ghosting program and I didn't have the resources to keep a ghosted image of every single client's systems on a hard drive somewhere.

[Revolting cat!]

I run my SPARCstation for 6-9 months without rebooting. I recall running a VMS host for close to 2 years without a reboot. But let me tell you, without mentioning any names, not all UNICES are as solid as Solaris.

[Northern Alliance]

Just wipe C: and reinstall everything.

May not be so easy depending on what 'everything' is, then the programs have to be configured to the way the user likes them again. If they are not sophisticated enough to have made copies of *.ini and other config files, backed up their IE or Firefox settings, etc., that can be very time consuming. Then there are also files like custom dictionaries that will have to be reconstructed unless backed up, which very people even know how to do.

[Looking4Truth]

This should apply not just to the OS but to these layered products. Instead, such products themselves typically intermix data, configuration files with their software and essential files. Chaos reigns...

I'm with you on that, too. It's maddening when you have tons of apps intermingled with OS directories.

At least back in the DOS days, you could have a separate dir for each app and there was no intermingling.

Life was much simpler back then.

[VeniVidiVici]

Here. Follow this link and get the latest version of MSNCHECKER. You don't want to miss any upgrades.

[Looking4Truth]

Then there are also files like custom dictionaries that will have to be reconstructed unless backed up, which very people even know how to do.

I've got to get off of this thread because I don't even do IT anymore, but I can tell you stories about clients who bitched at me because so and so was 'missing' after I had to re-do their systems. Some of the time was my fault for not asking the right questions or checking things I should have, but most of the time it was not.

[Looking4Truth]

My Windoze XP Home Edition box has over 100,000 files and God knows how many directories (folders for MS twerps) on a clean install with no other apps or data on the drive.

I meant Media Center edition. I wouldn't waste my time with XP Home Editon.

[Imperialist]

"you have to admit that the competion from both IE and Netscape made each much better.
Definitely. It usually does. But the war's over, and both sides quit playing."

MS has IE 7 beta 2 out. Maybe MS is trying to play, but IE 7 beta 2 is pathetic. Anyone eles try it out yet? IE 7 beta 2 has been banished from my collection of computers, total crap.

[Looking4Truth]

Here. Follow this link and get the latest version of MSNCHECKER.

Just Damn.

Hey thanks. I knew I shouldn't have let my McAfee license expire.

I feel like a total dumbass after talking about doing IT work.

This has just made my sh*tty day even sh*ttier.

That's what I get for being too lazy to research stuff.

Thanks again.

You don't want to miss any upgrades.

Thanks for getting me to laugh at myself, I sure needed it today.

[unixfox]

I can tell you from personal experience this is NOT fun. I had a client who got infected by a rootkit on every machine in their office that did not have XP SP2 on it. For some reason XP SP2 protected those machines.

Since the machines are getting aged we decided to just replace them instead of spending numerous hours trying to clean them up.

One of the worst weeks of my life!! If I ever find the little toads that write these I will personally invite everybody I know to a stoning.

[Musket]

Ha-ha. I feel vindicated - me and my ghost b-u's.

[Fishrrman]

I'm on a Mac.

What's malware?

/laughter off

- John

[Looking4Truth]

If I ever find the little toads that write these I will personally invite everybody I know to a stoning.

I want the first ticket.

[babbabooey]

Yea, new clients could be a problem...

I don't trust "system restore", it works for a lot of situations.

If u wanna be sure u can get your system back to life without a re-install... it only takes $50-100 bucks per machine, an external USB 2.0 HD Enclosure Drive (or u gotta open up the machine to get to the IDE/SATA), & A Ghost Image of your Drive is sure & quick.

I can even get some of my clients complete HD onto 1 Dual Layer DVD per machine...

[glorgau]

All total, I've probably spent days and weeks combined waiting for systems to re-boot. Probably months all total re-installing crappy bloatware.

And if you're a consultant, probably most all of it billable. Windows is a money maker. ;-)

[Diplomat]

Of course it wasn't techinical, the reasons are entirely LEGAL.

They know McAffee and Norton would sue the crap out of them if they embedded it into the Operating System. Much easier to just sell it as another separate product and avoid the whole expensive mess.

[Bloody Sam Roberts]

"I say we take off, nuke the site from orbit. It's the only way to be sure."

[DemosCrash]

In other words, there's NO technical reason to not include virus protection, BECAUSE WE MAKE MONEY FROM VIRUSES!

No, anti-virus software would have been considered middleware and, if MS had included it, it would have been sued by anti-virus makers for "violating antitrust law".