What you need to do if you're infected!

There’s no way that every tool in the all world will find out all infections. There are some infections that will still prevail after a standard or even full format of the system. I’ve seen some people ask for help in the biggest and greatest security forum in my country, because their system was severly infected and not even with a full system format they managed to get rid of the malware. How they know that? The AVs and ■■■ still warned for that very same fact.

I respect the malware developers so badly, that if the situation requires, well, format. I never had to, though.

And considering the time that someone would waste checking with all available tools, well a format and a clean install would be quicker and cleaner. Don’t you agree?

Also, what do you mean as DBAN’s site being broken?

It’s only “essential” if it’s “absolutely necessary, indispensable” [Random House Unabridged Dictionary]. Since the job can be done without it, it’s not “essential”, whether helpful or not.

Of course not. My daughter considers chocolate to be “essential”. :wink:

John

Installing SP3 trashed your machine?!
Reboot to last good configuration wasn’t possible?
Rollback wasn’t possible?
System Restore wasn’t possible?
Repair install wasn’t possible?
You had no Backup?!

John

Thus far at least I’ve always been able to find all the infections using multiple tools. :a0

The only thing that can survive a reinstall is a boot sector virus, which is easily fixed: :-La

I’ve never seen a proven case of anything other than cockpit error. If you know of any proof that can actually happen, please provide the citations. (:s*)

They aren’t magicians, and hysteria can be counterproductive.
My money is on the good guys. :-*

I think checking and disinfecting generally takes much less time. :-TU

Home → DBAN Documentation → Quick Start :-TD

John

Hmmm first of all this is going way far the intentions I had with this thread, but it’s nice to have a discussion like this :-TU

I created this thread so that most users would be able to clean their pc with a simple, fast, 95% chance and safe clean-up. By adding all the tools you guys already sujested, it’s not really simple anymore 88).

Anyway, I’m home in 4 days, then I’ll start making a more comprehensive and advanced one.

I've seen some people ask for help in the biggest and greatest security forum in my country, because their system was severly infected and not even with a full system format they managed to get rid of the malware. How they know that? The AVs and ■■■ still warned for that very same fact.
Malware could perhaps survive a simple format to 3 times format, but there is just no way that they can survive a 20times format :)

Now let’s keep discussing, I love to learn about this
Xan

Actually the only page that is MIA on the DBAN site is the Quickstart page.
Probably being rewritten?

Neither here nor there though.

Go hard guys. :-TU

I think the basic problem is that malware isn’t 95% simple, and not everyone would agree with your choices.

My own advice for average users is Ultimate Boot CD for Windows. For clients and friends I’ve created my own version with all the best free malware tools, ready to use – makes a great Christmas present! :a0

I don’t think you were being serious, but for the benefit of lurkers reading this: malware won’t survive even one simple format. :-La

John

That’s normal, it would be boring if everyone agreed with me :slight_smile:
Well, problem is that not everyone is an average user. This sticky was made for the novice and helpless ( ;D) user, I think most users like me (average) can take care of their own computer and don’t really need a sticky ? If I would create such one some novice users might think that they’re better than they’re (no offence to anyone:)) and get in trouble. So I kept it to this one

I don't think you were being serious, but for the benefit of lurkers reading this: [i]malware won't survive even one simple format[/i]. :-La
I was hoping Ganda would fall for this one ;)

Xan

I respectfully disagree – I think it’s reflective of attention to detail and concern for quality – if they don’t care enough to get the website right, then I don’t trust them to get the software right either. No reason to use it in any event with quality free commercial tools available like Seagate SeaTools for DOS. :-La

John

No disrespect intended, but I don’t think what you posted is within the capabilities of the “novice and helpless” users I know – I think you’re assuming much more knowledge and skill than they have.

That’s why I provide Windows boot CDs to clients and friends with malware tools pre-installed and ready to go. (I’m about to add CIS A-V to the CD.) I know I’m still going to get called on the phone, but at least they already have what they need to get going again “95%” of the time without my having to drive over. :wink:

But especially since that this is a COMODO CIS Forum, I think the best advice is to tell them to take Melih up on his generous offer: sign up for a free trial PRO account, and let COMODO experts deal with the problem! :-TU

John

Nothing would start at all, immediate BSOD. I could recover the original Dell, but that was all.

Fortunately I had all my own files backed up at Mozy, so lost nothing. Just the time installing all my programs.

Nobody could help on the Dell forum or others.

Sorry to hear that! Do you mean you couldn’t even get the F8 pre-boot menu? If so, your boot sector and/or boot loader were probably trashed, probably by malware, so a reinstall may have not been a bad idea, but next time you might want to try booting from a Windows CD into the Recovery Console [link in my prior post].

If you don’t have a Windows boot CD, get one from Dell. Now. :-La

And consider making your own Ultimate Boot CD for Windows [link in my prior post] before the next unexpected disaster. My strong advice to my clients is to test their disaster recovery before a disaster occurs, not after. :wink:

John

Thanks John.

No there was no malware, just something really odd with my SP3 install, I should have waited for auto update to offer it, so my fault for being impatient.

Next time I will send you a pm from my notebook.

No don’t worry only joking. Most of us here are not computer professionals like you, but good to see another sailor as I am posting this from my boat in Spain.

(:CLP)

@JNavas

I have tried UBCD4Win, but it seems like it only works for XP and I don’t have XP. Can I download somewhere a premade UBCD or some recovery/malware remover .iso?

Keeping a Restore Point in my experience may just trade old infected Restore Points for a new infected Restore Point, not solving the basic problem of infected System Restore. See “Remove infected files that you cannot clean in the System Restore data archive” in KB831829.

Other problem with System Restore:

  • It may not be able to undo attempts to remove malware – I’ve not infrequently had Restore Points fail to work, and System Restore can fail completely – see KB841568.
  • It’s not able to restore all files – see KB281842 and KB293889 for some examples.
  • It can delete files – while files in My Documents are protected, files in other locations may be deleted – see KB261716.

For all these reasons I personally recommend relying instead on a system backup – I backup the system before attempting disinfection, if possible. (USB hard disk is what I typically use and generally recommend for backup.) Then I turn off System Restore before disinfecting.

John

If you have removed the malware before creating the new restore point, how would that one be infected?

Sure. The non-Windows Ultimate Boot CD has a direct download link for a CD ISO image. :-TU

What OS do you have?

John

You can get reinfected from malware in a Restore Point even without running System Restore – malware can use the System Restore area as a repository to reinstall itself while you are attempting to uninstall it. The point of turning off System Restore before attempting disinfection is to delete all malware in Restore Points to help make sure the system doesn’t stay infected or get immediately reinfected. See “Remove infected files that you cannot clean in the System Restore data archive” in KB831829.

John

I am very, very jealous!

You might enjoy my Sailing & Racing website.

John

Heck! I wouldn’t be the one wasting my time formating like 20 times!!! :smiley: