Norton Internet Security / Norton AntiVirus

[Kelly]

Twixt, Quads, & Joen,

Yes, the posts help my understanding tremendously.  All valid points, and the explanations make perfect sense, more so than the troll, malefactor, or conspiracy theory.  But one still has to wonder.  Had I not gone to the French and German forums, spent a couple hours looking at them, and noted they were pretty quiet, I couldn't help but consider that an anomaly.  Surely these rootkits wouldn't be confined to English-speaking countries - or would they?

My computer skills pale in comparison to others', and I certainly know my limits.  I can handle removing Rogues and few other simple routines, but that's about where it stops.  I wouldn't even want to try to remove a rootkit.  But it never ceases to amaze me how many people disregard common sense warnings.  Use of P2P programs has potential for disaster written all over it, though I recognize there are loads of folks who want to pirate music and video files to bypass paying for them.  And when it comes to porn, I look at it as the 21st century equivalent of the Playboy hidden in the corn crib during my younger days.  For an adolescent and young adult guy, it's almost a moral duty to look at porn whenever possible (a direct quote from a teenage nephew).  But looking at a paper Playboy never resulted in a rootkit, though it would incur the wrath of Mom if caught.  Add to that just maintenance tasks of keeping OS, AV, and application software up to date that get routinely ignored. 

The way I look at it, anti-virus software (though improving but will not likely reach 100 per cent effectiveness) is only one part of the security equation.  When some in my circle of family and friends get hit, they immediately blame a fault in the AV software for not catching it (assuming they have it at all).  But users have responsibility for security as well, my way of thinking.  Like staying out of bad cyber neighborhoods, using legit software, and so on.  But there are some who would walk in the dark through a crime-ridden area in a large inner city with money hanging out of their pocket, then wonder why the police wasn't right there with them to keep them from getting mugged.  There's only so much area a police force can cover at any given time.  And we all know how people scream when we even remotely suggest the victim was a significant contributor to the event, so we don't.  I look at computer security pretty much the same.

Thanks again for your thorough and easy-to-understand explanation, both here and in an earlier post.  I come here to help when I can, but I learn a lot in the process.

Regards,

Kelly

[Kelly]

Quads, I don't know of another of you anywhere :-)

Kelly

[2YsUR]

---

Kelly wrote:

... 

I browsed through the French and German forums (I'm competent with both languages) to see what's going on there.  Strange, there's little mention of it in either forum. ... 

---

The main goal of much of the malware is to make money by stealing financial/bank card info from computers.  The computer owners with the greatest financial assets are in the USA and therefore the USA is the main target for such attacks.

[twixt Regular Contributor]

---

sturgess wrote:

Hi twixt,

Windows 8 has a " Remove everything and reinstall Windows" option, would this be a fix ?  Enjoyed reading your post.

---

Hi, sturgess.  It might be possible - using the Recovery Environment - to check to ensure a full Image Restore goes onto a disk that has had its MBR rebuilt and a fixit-partition (if present) destroyed.  Am I willing to swear on a stack of Bibles that the tools are actually present?  No.  In this case, I would love to be proven wrong.  However, I'm not holding my breath.......... [gasp, wheeze] 

This is my understanding of how W8 allows you to work in the Recovery Environment:

As far as I am aware, W8 will respect an existing Partition Set when restoring an Image.

If a bootkit has created a fixit-partition and the MBR that takes the machine to the fixit-partition for validation-for-reinfection-if-the-infection-is-not-present-on-the-OS-Partition, W8 is not going to help you in that regard.  You are already infected by the time you reach the Recovery Environment extant on the Hard Disk - and that MBR and fixit-partition is going to promptly "self heal" and thus reinfect the newly-restored OS Partition recreated from the Image - even if the Image itself is uninfected.

See the second comment at the base of the article at the noted website for an example.  There's the cards boys - read 'em and weep:

http://redmondmag.com/articles/2012/05/23/windows-8-boot-options.aspx

So, you are still going to need access to a bootable CD-ROM or DVD-ROM that has a dedicated W8-smart Partition Manager, along with a W8-smart MBR-recreation-tool.  As far as I am aware so far, that stuff is not present on the W8 Install Disk - and accessible for Partition Examination/Management and MBR Investigation/Replacement outside of the Install process - other than from the Command Line as has been present since Vista.

Thus, the need for Third Party Tools.  After you've nuked the fixit-partition (if present) and reset the MBR properly using the tools on the Bootable CD/DVD-ROM - then you can try using W8's Image-Restore tools.  Me?  I'm looking for something with a track-record of working-in-the-real-world- from-beginning-to-end - and I want a toolset that is accessible and usable without having to thrash around at the Command Prompt.

I also want to be able to delete/create/shrink/grow Partitions from that Recovery Environment - so I can expand an existing Partition over top of a deleted fixit-partition to ensure that thing gets nuked when the OS Partition gets full-formatted.  Yes, full-formatted - in order to clear an OS Partition that has bootcode hidden in "bad sectors" that aren't bad sectors.

I think it's utterly inexcusable that Redmond has had a decade to sort this stuff out - and there's still no practical way to check for the presence of a corrupted (infected) MBR - or for unauthorized modifications to the Partition Table - with tools on the Installation DVD.

Come on guys - this is 2012 and this stuff is not Rocket Science.   This is the logical extension of basic dingbat maintenance tools that everyone familiar with Windows' Disk Management and FixMBR have been using for a decade.

Conclusion:

Yes, IMO this stuff ought to be on the Install DVD and accessible for Repair Operations while booted from the DVD.  We shall see if Redmond giveth or Redmond taketh-away.

Hope this helps.

[Krusty13]

---

Quads wrote:

..."doesn't really matter, maybe they don't have a Quads "

Quads

---

[sturgess]

Hi twixt, Your comments are very much appreciated and I thank you. I was pinning my hopes on Windows 8 but now I'm not so sure. I have to believe that moving to the likes of a Chromebook may be the way to go ? Based purely on how secure they are, what do you think ? Should you be willing to share what security you have installed I for one would be very interested.

[Kelly]

As far as Windows 8 goes, I haven't tried it out or even seen it yet, though I've been reading suggestions to skip it and wait for Windows 9.  The conventional wisdom seems to be that Microsoft gets it right every second version; witness those who claim Windows 7 is what Vista should have been.  I used Vista (and still do) at work and haven't had any problems with it.  Seems that Windows 8 is geared for the touchscreen user, but since my home computers are relatively new, I'm not going to upgrade.  As the saying goes, if it ain't broke don't fix it.

Based on comments here and elsewhere, I'm starting to re-think using the Windows 7 back-up feature.  I've been using it to back up to an external hard drive for quite some time now.  Fortunately I've never had the misfortune of suffering from malware infection at home, making me either the most boring or luckiest person on the planet.  Maybe it's time to install and use Ghost.

Thanks all for the informative dialog.

Regards,

Kelly

[ablatt]

Even IF (and it's a big if) all these trojans were a conspiracy to make Norton look bad, or due to out-of-date signatures, what about CLEANING?

Is it reasonable to expect that after buying a top tier product like Norton you have to be told to use Malewarebytes (seen that for years) or other third party tools to clean out infections?

I must say, that when my subscription runs out, and I've been a very loyal Norton customer, I will have to consider Kaspersky or some other product.

[SendOfJive Norton Fighter]

---

ablatt wrote:

Is it reasonable to expect that after buying a top tier product like Norton you have to be told to use Malewarebytes (seen that for years) or other third party tools to clean out infections?

---

Yes, it is not only reasonable, but it is a common practice on all malware removal forums.  Some malware can do severe damage to an operating system that is beyond the scope of consumer-grade AV products to remediate.  RIght now there are posts on the Kaspersky virus forum where ComboFix and other programs are being used.  There is also at least one thread there asking why Kaspersky was not able to detect  ZeroAccess on an infected system (think about that in terms of why the Norton forums may have more Zeroaccess topics than some other forums).  As Quads has been saying, Zeroaccess is a problem for everyone.

[sturgess]

SendOfJive "As Quads has been saying, Zeroaccess is a problem for everyone"
True but the difference between NIS and Malwarebyte Pro is that for licensed users of Malwarebytes Pro, there is free, one-on-one, expert assistance from the Malwarebytes Anti-Malware support helpdesk.