huwyngr wrote:Twixt,
Many thanks for that detailed explanation.
I'd appreciate a comment on: I use a utility called EasyBCD and I also make images of my hard drive.
1-- EasyBCD offers the ability to recreate the MBR/Bootloader
2 -- When I restore an image (I normally use a version of Acronis True Image which you can download free from the maker of most hard drives) I seem to remember that one of the options is to restore the MBR or not.
Am I right in thinking that these do offer a way of repairing the MBR in the event of malware having infected it?
Hi, Hugh.
1. Yes, EasyBCD is a godsend. It's part of my toolkit here as well. I won't leave home without it. 
2. Yes, both Ghost and Acronis True Image offer an option to restore the backed-up-copy of the MBR along with the Target Partition when restoring an image. IMO, it is appropriate to replace the MBR whenever you Restore an Image because "something is goofy" about how your OS is running.
Some other things about Images:
1. Nowadays, having a single-level or even a 3-level image stack is insufficient. I run a 5-level stack here. The reason for this is because it is not always obvious that you've been infected with a rootkit/bootkit.
Reasons for the above:
1. The very best rootkit/bootkit code is as completely-stealth as possible.
2. The code modulates its CPU usage so that it does not load the CPU when the machine is idle. You will not be able to tell you are infected simply because the CPU usage spikes when you know that "nothing" is supposed to be going on. The code ensures that it only adds to an existing CPU load - thus masking itself from simple detection by the presence of CPU activity when the machine should supposedly be idle.
3. The code modulates its activity such that its network traffic only occurs when other legitimate traffic is also taking place. You will not be able to tell you are infected simply because the Router shows network traffic when you know that "nothing" is supposed to be happening.
4. Thus, if you don't know what to look for - you can go for weeks with a keylogger in place (harvesting your bank login data) and have no idea you're infected. Meanwhile, you are diligently doing your backups and creating new infected Images - which you dutifully restore when NIS is updated to the point it can detect that particular set of stealth routines. And then, when you restore an infected image - NIS promptly informs you after the restore is complete (and NIS is brought up to date using Live Update) that you are still infected.
5. You need multi-generational backups that go far enough back in time that you can be sure you have a clean OS Image back there somewhere. Even if it's 5 weeks old - having a clean Image in the stack is preferable to having to reload the entire OS from scratch.
6. Another thing I do is Archive an OS Image separately from the stack every month, and keep a 3-month-interval stack of archives back from the current 3 months. I keep as many of these on my External Hard Disk set as is consistent with maintaining enough free space to allow the 5-level-stack to maintain itself automatically. This ensures that even if the stack is completely infected - I've got something that isn't - as long as I go far enough back in time.
7. Please note that the procedure detailed in Item 5 is a relative of the procedure used for Permanent Archiving in Commercial or Government arenas - where it is utterly necessary to have a reliable audit trail for the 7 years mandated by Law for legal liability. None of what I am describing is new - but it is only recently, with the effectiveness of stealth rootkit/bootkit technology - that it has become important for typical Computer Users to adopt the backup techniques used in Commercial and Government agencies for decades.
Hope this helps your understanding.
- �1995 - 2013 Symantec Corporation Legal Notice License Agreement Privacy Policy Cookies Site Map RSS
