- How does malware infect machines.
- Posted by Dave Budd on April 23rd, 2008
In article <6h6u04l870rtu03skul4042imfhemsi5s9@4ax.com>, SomeoneElse
(not@telling.com) says...
Yes, of course. You haven't closed any security holes. All you've done
is give yourself a way of rolling your system back to a known state.
If you make it "All binaries", not just the ones you think are part of
the system, then you have a setup where the malware can only live until
the next boot.
But, you know, it's a lot of hassle and is going to severaly affect your
startup times. Why not just get a NAT router and hide your machine
behind it, be sensible about which mails you open and how, and which
websites you go to, and that'll be that.
--
Snob? Were I a snob, I wouldn't be talking to you.
- Posted by Dave Budd on April 23rd, 2008
In article <nldu04hirpds72cfgvk7lhffp0glq7428m@4ax.com>, SomeoneElse
(not@telling.com) says...
Some malware leaves its executables in odd places, so you wouldn't be
sure there wasn't something lurking. If your DVD copy of the registry is
known to be good it'd probably be safe enough - but so many legit things
alter the registry regularly that you'd need a new backup every time,
and you'd have a hard time being sure it was clean.
I should perhaps have written "all executables". And you'd want to check
your disk for any that appeared that aren't in your known safe set.
General advice is to use an email client that won't open executables. In
fact to save to your local disk before opening anything, rather than use
the email client. That way your antivirus gets a shot at checking it.
Maybe it's because I'm in the business, but I like to think I can spot a
dodgy attachment whatever it pretends to be called or contain. I'll
probably get whacked tomorrow, now, though.
It's true that websites, or previously legit ads on them, get subverted,
so somewhere that ought to be safe may not be these days. I really ought
to run some antivirus on the home machines. Here in the office I keep
everything pretty tight.
--
Snob? Were I a snob, I wouldn't be talking to you.
- Posted by Leythos on April 23rd, 2008
In article <nldu04hirpds72cfgvk7lhffp0glq7428m@4ax.com>, SomeoneElse
(not@telling.com) says...
Your process does not even gurantee that you can recover from a
corrupted installation or other.
Video can carry malware, PDF's can carry malware, documents can carry
malware...
I've been online since the 70's, and never had a compromised machine of
my own, never had a clients network compromised while we controlled it.
The only way you can make a backup that will get you back to your last
confirmed good point is to make a FULL IMAGE of the drive and keep them
for weeks - since many malware are not discovered for weeks.
--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)
- Posted by Leythos on April 24th, 2008
In article <sigv045kht8tt5h7tkqn8a6v3ea1ddcic9@4ax.com>, SomeoneElse
(not@telling.com) says...
because you said "System Binaries" and that doesn't even come close to a
good backup or the possible number of files that could be infected and
cause you to be reinfected.
--
- Igitur qui desiderat pacem, praeparet bellum.
- Calling an illegal alien an "undocumented worker" is like calling a
drug dealer an "unlicensed pharmacist"
spam999free@rrohio.com (remove 999 for proper email address)