In order to remove exectued malware, reinstall your operating system

In order to remove exectued malware, reinstall your operating system
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
In order to remove exectued malware, reinstall your operating system Thor Kottelin 06-20-2008
Posted by Volodymyr M. Shcherbyna on June 20, 2008, 8:22 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Well, the best way to clean machine is to leave it in the right place, pay
money and get it after some time cleaned and "cured". There are many ways of
how to get rid of viruses. One of the way - debug machine using WinDbg
kernel debuger, and with the help of it force the "bad" code to stop
execution.

Re-installation of OS is not the best solution.

--
V.
This posting is provided "AS IS" with no warranties, and confers no
rights.
> Instead of replying to every single "I have a virus" post, I am going to
> say this once.
>
> The best current practice for cleaning up a system on which malware has
> been executed is to reinstall the operating system cleanly. Vendors will
> offer you software, bells and whistles to no end, but the only way to be
> certain that your system is clean is to reinstall it. Of course you need
> to do this in a way that does not repeat whatever you did in order to have
> the malware installed in the first place.
>
> You do need is a good antivirus and firewall product to continuously
> protect you from intrusion attempts. This is absolutely vital. In
> addition, your virus scanner will try to remove any non-executed malware
> from e.g. incoming email. However, once malicious software has actually
> run on your computer, you should reinstall.
>
> Please believe me when I say that professional sysadmins do not wield
> FixCleanSuperThis or WizKillHyperThat when cleaning up after e.g. a server
> compromise. They try to work out how the intrusion occurred, and then they
> reinstall the system from scratch, in a way that does not reopen the
> previous attack window.
>
> Your comments are welcome.
>
> --
> Thor Kottelin
> http://www.anta.net/
>
> Antivirus, firewall, parental control: http://www.anta.net/sw/norman/
>



Posted by ~BD~ on June 28, 2008, 12:29 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Well, the best way to clean machine is to leave it in the right place, pay
> money and get it after some time cleaned and "cured". There are many ways
> of how to get rid of viruses. One of the way - debug machine using WinDbg
> kernel debuger, and with the help of it force the "bad" code to stop
> execution.
>
> Re-installation of OS is not the best solution.
>
> --
> V.

You say "Re-installation of OS is not the *best* solution Volodymyr.

My question to you ................ Although maybe not *the* best solution
.......... Will re-installation of OS *always* leave one with a totally
clean machine?

Did you note my comment to David Lipman? Viz:-

"Do you, personally, feel it unecessary to delete ones partitioning on a
single HD (thus losing all data) before re-partitioning, formating and then
reinstalling from scratch?

Perhaps malware can remain resident in other areas inside a computer, not
just on the HD.

Is this possible? If so, where else could it hide ........ and for how long
after power curtailed?"

I'd very much appreciate your view(s). TIA.

Dave



Posted by FromTheRafters on June 21, 2008, 5:26 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

> Instead of replying to every single "I have a virus" post, I am going to
> say this once.
>
> The best current practice for cleaning up a system on which malware has
> been executed is to reinstall the operating system cleanly.

Generally yes, but if a *known* malware has made changes, they can
be reversed in many cases. However, once we delve into the unknown
(such as when a known trojan downloads an unknown and executes it
or a backdoor has been exposing you to unknowns) the best method is
as you have suggested - flatten and rebuild.

> Vendors will offer you software, bells and whistles to no end, but the
> only way to be certain that your system is clean is to reinstall it.

Certaincy is a funny thing, how would you know the *original* problem
is not still there even after reinstalling from what you assume is *clean*.

> Of course you need to do this in a way that does not repeat whatever you
> did in order to have the malware installed in the first place.

Knowing the malware involved could give a hint as to what method was
used to attain the result desired by the malware author. A SuperAnti-
wild-assed-guess -- flatten and rebuild approach does nothing to counter
the *next* one using the same or similar method. Best to analyze the
intrusion and take action. Your method does not of course prevent
someone from saving the compromised system aside (maybe the HD)
for forensic study, and placing a (cough) *clean* system in its place.

> You do need is a good antivirus and firewall product to continuously
> protect you from intrusion attempts. This is absolutely vital. In
> addition, your virus scanner will try to remove any non-executed malware
> from e.g. incoming email. However, once malicious software has actually
> run on your computer, you should reinstall.

I agree, with the stipulation that the malware does something leading to
the *unknown* factor. It is perfectly alright to remove known changes.

Some malware is really simple to remove, so why go overboard.

> Please believe me when I say that professional sysadmins do not wield
> FixCleanSuperThis or WizKillHyperThat when cleaning up after e.g. a server
> compromise. They try to work out how the intrusion occurred, and then they
> reinstall the system from scratch, in a way that does not reopen the
> previous attack window.

Sysadmins probably don't load their servers up with *fluff* that they
feel they need to reinstall. Most users have lots and lots of stuff they
haven't even backed up, let alone incorporated into their reinstallation
media, that they just can't live without.

Sure, the result of getting bitten *should* be pain - the recovery process
should leave a lasting impression on the user to learn how to avoid the
clearly avoidable and backup - backup-backup!



Similar ThreadsPosted
System tray pop-out "buy me - to fix infection" type malware... September 23, 2008, 3:29 am
remove malware - drive cleaner January 13, 2007, 1:09 pm
Is Skype Emotions Art a malware? How to remove this junk? January 18, 2008, 11:22 am
reinstall ...or just hope ? July 16, 2006, 5:37 pm
System.ini January 23, 2006, 9:52 am
System shutting Down June 28, 2005, 1:21 pm
NT AUTHORITY SYSTEM September 13, 2005, 5:52 pm
system error December 12, 2006, 3:18 am
System Alert!!! January 24, 2007, 12:06 am
System Volume Information...WTF December 14, 2005, 8:57 am

The site map in XML format XML site map

Contact Us | Privacy Policy