Re: cydoor/altnet & others

From: Stefan Kanthak (postmaster_at_1.0.0.127.in-addr.arpa)
Date: 08/08/05 

Date: Mon, 8 Aug 2005 19:59:05 +0200

"PA Bear" <PABearMVP@gmail.com> wrote:

> Inline!
>
> Stefan Kanthak wrote:

[snake oil]

Sorry, but you can't clean a compromised system with all these "tools".
Will they find all backdoors? All modified registry entries and files?
For sure? With a rootkit in place?
No scanner can guarantee the ABSENCE of malware, and most of them won't
even detect the presence of malware.
So the really effective and in most cases also efficient way is to
flatten and rebuild. The rebuild has to be done right to have the
holes fixed that gave the attackers the possibility to infect the
system.
 
> > PS: Please stop top posting!
> > Your Outlook Express creates superfluous linebreaks in the cited
> > text!
>
> I beg to differ here, too:
>
> - There is no mandate as to top- or bottom-posting in MS newsgroups.

Wrong: http://support.microsoft.com/default.aspx?scid=fh;DE;NGnetikette

> - *Your* outdated and much less-secure version of OE (v5.50.4952.2800, from
> your headers) is what's causing the breaks,

Completely wrong: OLEXP breaks ALL lines, even the quoted ones, at the
margin when you hit "Send".
Therefore you don't see how your post will look when writing or answering.
Since quoted lines are longer they'll more likely end up with additional
line breaks. See http://oe-faq.de/
This even holds when using "format=fla^Howed": this is broken TOO in OLEXP!
Just compare the OP and your two posts where you quote it.

> my friend, and it's not just my posts where you find line-breaks:
> http://groups.google.com/group/microsoft.public.security/msg/e4cc975cd5e69984?hl=en&
>
> (In fact, unless you're running Win95, your IE and Windows version are
> outdated and much less-secure as well.)

And that's wrong too: IE 5.01SP4 and OLEXP 5.5SP2 are supported versions
for Windows 2000 SP4 and still get all the security updates there.
In fact IE 6SP1 has MORE unpatched security holes than IE 5.01SP4.

Stefan

PS: Using an invalid "Reply-To:" while posting with apparent valid "From:"
    is ... hmmm ... ridiculous?

Quantcast