Re: will reformatting remove all spyware?

From: Leythos (void_at_nowhere.lan)
Date: 02/13/05 

Date: Sun, 13 Feb 2005 14:23:58 GMT

On Sun, 13 Feb 2005 04:39:37 +0200, cquirke (MVP Win9x) wrote:
>
> When you "just" wipe and start over, you invariably fall back to the
> form of software that was originally considered "fit to ship" - i.e.
> without subsequent patches (repairs) needed to block evolving attacks.

There are a couple things to consider in the wipe/reinstall method:

1) If you are not on a protected network when you wipe/reinstall you are
likely to get compromised before you finish the Windows installation, even
before you try and get the patches - A protected network is necessary, or
installation without connection to the network and then the installation
of a personal firewall before connecting to the network to get patches.

2) Routers with NAT for DSL/Cable users are cheap and provide a great
first barrier to compromise, they do nothing about malware, but they do
get you online without being compromised while the computer just sits
there.

3) Routers with NAT almost always provide a logging method that permits
you to see in/out bound traffic with detail - this is a great tool for
determining if you have a compromised machine on your network.

4) People need to learn to run as User level (limited) account types
instead of Administrator level account types - this one thing will benefit
most users more than anything else (except the router).

5) Many AV programs now detect malware and can remove it - Use a quality
AV product. Make sure that the AV product can scan in/out bound email with
the email program you use.

6) Use an alternative browser - or use Microsofts directions to put IE in
high security mode. HS mode for IE breaks most web sites, but it will keep
you from getting compromised while using IE on questionable sites.
Actually using an alternative browser like FireFox is a better choice,
while it's not exploit free, it is MUCH less susceptible to the typical
compromise methods the user will run into.

There are a bunch of other things, but nothing is going to stop spyware
being installed and running if the users want to run programs that provide
spyware as part of their packages - P2P programs are notorious for spyware
being included, and there is little reason to use P2P apps, but people
still do.

One last thing - while wipe/reinstall has been likened to using a sledge
hammer to kill a fly, it's the only method a typical user has that can
ensure that their system is clean. 

-- 
spam999free@rrohio.com
remove 999 in order to email me

Relevant Pages

  • Fwd: CERT Advisory CA-2003-08 Increased Activity Targeting Windows Shares
    ... poorly protected file shares. ... Intruders have been able to leverage poorly ... The network scanning associated with this activity is widespread but ... W32/Deloder attempts to compromise the Administrator ...
    (Bugtraq)
  • CERT Advisory CA-2003-08 Increased Activity Targeting Windows Shares
    ... reports of systems running Windows 2000 and XP compromised due to ... poorly protected file shares. ... The network scanning associated with this activity is widespread but ... W32/Deloder attempts to compromise the Administrator ...
    (Cert)
  • Re: SSH hacked?
    ... No wireless in your network range. ... encrypt backups ... You can't trust it. ... compromise are also worthless. ...
    (Ubuntu)
  • [Full-Disclosure] Is Marty Lying?
    ... The compromise must definately have been limited to ... their network so if it gets compromised, ... Snort/Sourcefire network's security. ... booger at night - I'm the security snot." ...
    (Full-Disclosure)
  • RE: Network Security Related Query
    ... Enabling IPSsec could prevent the sniffing and regular ... Subject: Network Security Related Query ... This would depend on the state of the windows machine ... All in all to answer your question, system compromise is possible depending ...
    (Security-Basics)