1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Other things to do after with a Virus attack

Discussion in 'Security and Privacy' started by BillyBob, 2003/08/12.

Thread Status:
Not open for further replies.
  1. 2003/08/12
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Thoughts, Questions and maybe even looking for answers

    Or maybe just plain confused.

    I have read several sites ( including Symantec ) that give instructions on cleaning out a Virus.

    I have read about how to get the Virus out of a system.

    I have read about the Restore Points in ME and XP.

    But on many sites I have not seen any mention of the Registry backup files in 98. ( The RB00X.CAB files that 98 makes. )

    On many sites I have not seen any mention of any drive image files. Things like GoBack, Ghost, Drive Image etc.

    If this files are on the HD then they COULD BE infected also.

    Isn't there at least one of the image program that auto updates itself ? If so I would call that one very likely to be infected.
     
    Last edited: 2003/08/12
    BillyBob,
    #1
  2. 2003/08/12
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    Not sure exactly what your questions are!

    IMG files or as in Norton's GHO files, are safe from viruses because viruses attack programs. Thisis why you never see a jpeg with a virus or a txt file that gets infected. However, the image maker program can get infected, ghost.exe etc etc.

    It's also wise to keep backup drive images on a CD. (I keep my images on a separate partition and CD's.

    What are you asking BB?
     
    TonyT,
    #2


  3. to hide this advert.

  4. 2003/08/12
    charlesvar

    charlesvar Inactive Alumni

    Joined:
    2002/02/18
    Messages:
    7,024
    Likes Received:
    0
    Isn't there a distinction to be made between "image" files - bit for bit - created by drive image software - and backups such as made by Ghost, etc?

    Regards - Charles
     
    Last edited: 2003/08/12
    charlesvar,
    #3
  5. 2003/08/12
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    IMG files or as in Norton's GHO files, are safe from viruses because viruses attack programs

    I do not agree if there is a possibility that a Virus existed when the IMG was made. I do not think any type of backup checks to see what is being backed up. It just backs up the files or folders it is told to regardless of what is in them.

    It's also wise to keep backup drive images on a CD. (I keep my images on a separate partition and CD's.

    It do not think it makes any difference where the drive images or backups are stored. Unless you can be 100% sure that it was NOT made while the Virus was present.

    If 98 Scanregistry does its job it makes a reg backup every day.

    If ME or XP does what it is supposed to do it makes Restore points.

    Or in XP you install something and SR does what it is supposed to and makes a RP.

    Or you yourself make a RP.

    If during any of the above procedures there was a Virus present it would be included in the backups. But wth the last two I would expect the user to do a Virus scan first anyway.

    This is why I think it would be nice if the Virus info sites would at least point out these varuous items that may exist.

    Also so if I undersatnd correctly from a post a long time back a Virus check/clean may do some cleaning to a RP. If this is true then that RP may not be suitable to re-use.

    So I think that if a Virus was found it would be in a users best interest to at least think about these things.

    I guess this is where I am asking what others think.

    A Friend of mine did not think at all. He found there was a Virus on the machine and made a backup BEFORE he cleaned the Virus. I tired to warn him but he thought I was wrong. Then he can B***hing to me becasue the Virus was back after he did a scanreg /restore in 98SE.

    BillyBob
     
    Last edited: 2003/08/12
    BillyBob,
    #4
  6. 2003/08/13
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    BB

    You are correct that if a virus existed undetected before an IMG was made, then the IMG will have a complete copy of the virus included in it.

    (FYI, an IMG and GHO are identical, the only difference is the extension. Ghost can create a drive image and save it as GHO or IMG.)

    And yes, ithe Restore points can get corrupted by an anti-virus program if the program detects a virus in the Restore Point files. That is why it is always best to then manually create Restore Points or drive images after thorough cleaning is done.

    In 98 systems, Scanreg is not always a 100% method of safety or restoring. For instance, a virus 'could exist' on a 98 box. And IF the virus has not yet executed, restoring the registry will not stop the virus.

    On the same 98 box, if the virus has executed, and made changes to the registry, using scanreg/restore can [put back a clean registry, but if the virus executable still exists on the drive, it can then still become activated and do damage. (many such viri will activate on certain times or dates)

    When I image a drive or partition I do the following:

    1. Ensure no viruses exist.
    2. Delete files or entire folders of Recycle bin, Temp, TIF, Cookies,History.
    3. Backup email box (Calypso or Courier) to other drive or partition or zip or CD.
    4. Ensure any other backups that may be needed ar done.
    5. Then I image the drive or partition.
    6. If this IMG will be used on a boot CD, I then put the IMG on a CD and leave the CD open so I can add the boot files or above backups to it.

    You are 100% right about imaging a drive with a virus on it. It is a useless backup and will cause further problems if the IMG is ever used.

    NAV and other apps can detect and repair viruses contained in an IMG, however, there is no guarantee that the 'repaired IMG' is now good and usable, even if the imaging program says the image integrity is OK. I would NEVER use an IMG that had been 'repaired'. That's a scary thought and a risk I would not want to take!!
     
    TonyT,
    #5
  7. 2003/08/13
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    Symantec covers the above: (may be mentioned at other vendor sites too but I never looked)

    NAV and System Restore
     
    TonyT,
    #6
  8. 2003/08/13
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Thank you very much TonyT

    BillyBob
     
    BillyBob,
    #7
  9. 2003/08/13
    Christer

    Christer Geek Member Staff

    Joined:
    2002/12/17
    Messages:
    6,566
    Likes Received:
    73
    A friend of mine had problems with his computer and asked me (of all persons available!?) for help.
    It was a virus (don´t remember which) and I cleaned it out but he didn´t have the time to say thanks before it was back.
    It actually launched itself from within the System Restore folder which was among the exceptions for scanning in the Anti Virus software he uses.
    I disabled System Restore to clear all restore points and reactivated. Of course, I also enabled virus scanning of the SR folder. Finally I cleaned it out once again and it never came back.

    No BillyBob, I won´t disclose which AV software he uses ...... :D ...... won´t get You started again!

    Christer
     
    Christer,
    #8
  10. 2003/08/13
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Christer

    Thank you very much also.

    Now if there is not POSITIVE Proof of what can happen then there will never any proof at all.

    System Restore does have its advantages. But if not handled carefully it can have disadvantages.

    Christer can sure vouch for that.

    :) FYI. The AV software being used has no bearing on this case. :)

    All I am trying to do and you and TonyT are HELPING TREMENDOUSLY is to get Users to realize that cleaning up after a Virus may be more than just getting it out of the Operating System files themselves.

    And one thing I forgot but I think should be mentioned.

    If you are on a Local Area Network CHECK THE OTHER machines also.

    BillyBob
     
    Last edited: 2003/08/13
    BillyBob,
    #9
  11. 2003/08/13
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    Exactly why I UNBIND TCP from File & Print Sharing as well as the MS Client. And then I use NetBeui instead. AFAIK, a virus cannot infect another machine on a LAN via NetBeui, all on it's own. But if users access other machines on the LAN and move, write to files, then yes, the virus can travel in an infected file that the user unknowingly transfers.

    An aside:

    BillyBob has been known to stick a virus in a golf ball and chip over to other machines on his LAN. However, this has only ever happened when he had a bad lie such as in the rough behind a tree or in a bunker without a wefge. This may or may not be true, but I have heard his wife accuse him of this when she was 7 strokes behind once!
     
    TonyT,
    #10
  12. 2003/08/13
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    EXCELLENT INFO

    I have also been doing that since the days of Win95.

    But as of yet I have not gotten NetBeui to work properly in XP yet. I keep seing errors in the Task Manager. But I have not tired that hard yet.

    :p As to the 7 strokes behind. My wife is almost never 1 stroke behind let alone 7 :(

    BillyBob
     
    Last edited: 2003/08/13
    BillyBob,
    #11
  13. 2003/08/13
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    Correction to previous post.

    I wrote Task Manger but it should be Events Viewer.

    BillyBob
     
    BillyBob,
    #12
  14. 2003/08/14
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    TonyT,
    #13
  15. 2003/08/16
    TonyT

    TonyT SuperGeek Staff

    Joined:
    2002/01/18
    Messages:
    9,068
    Likes Received:
    396
    TonyT,
    #14
  16. 2003/08/21
    BillyBob Lifetime Subscription

    BillyBob Inactive Thread Starter

    Joined:
    2002/01/07
    Messages:
    6,048
    Likes Received:
    0
    BTTT
     
    BillyBob,
    #15
Thread Status:
Not open for further replies.

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...