Re: Antivirus 2008
I'm sorry if you think I was patronizing. I also started in IT in the 70's,
although I don't know what this has to do with the conversation. At the very
least my experience has taught me that there are many different points of
view regarding computer security and that my view may differ from others. I
have learned that I need to be open to other points of view. There is no one
right answer when it comes to computer security. These newsgroups are read
by many thousands of people who may not have your experience and knowledge.
Many people will find these posts through a search engine. They need to know
that even though an anti-malware program may seem to remove some malware the
possibility exists that the computer is not "clean".
Once a computer is owned by someone else (infected) the only way to be 100%
certain the infection is gone is to flatten and rebuild the system from
known good media. This could mean starting from scratch or restoring from a
known good backup. A good part of my business is dealing with malware
infections. I have learned that an infected system can be repaired but not
definitively cleaned by any other other method. It is up to you to decide
how much of a risk this is. As you posted this in a server newsgroup I
assume the computer in question is part of a network. If this is the case
then by cleaning an infected computer you are taking a chance that the
computer may not be fully cleaned and may compromise the network. Balancing
the time and resources used between mitigating that risk and fixing the
infected computer is a decision only you can make. For me, if the computer
is part of a network that a business relies on, the best way to fix a
malware infection is to flatten the computer and restore a clean image.
There shouldn't be any important data on the computer so this is a quick and
easy fix. If the computer is not part of a network, or good network policies
have not been implemented, then other solutions may work better. I am
sometimes called in to fix things when something goes wrong due to good
network policies not being implemented. Like you, I sometimes resort to
cleaning an infected system as the customer does not want to pay for the
proper fix, which is not quick and easy because there is no image available
and company data is not stored on a server. This doesn't mean this is the
best solution or that I don't inform the customer of the potential risks of
this solution. The important thing to understand is that is is a compromise
and not the best solution.
--
Kerry Brown
MS-MVP - Windows Desktop Experience: Systems Administration
http://www.vistahelp.ca/phpBB2/
http://vistahelpca.blogspot.com/
"Alan C" <nospam@noisp.com> wrote in message
news:ua9zUAQEJHA.3604@TK2MSFTNGP06.phx.gbl...
> You don't seem to understand that I know what I am doing, having started
> in IT in the mid 1970's. Admittedly there is still a learning curve as
> OS's, etc, evolve, hence my questions to these ng's.
>
> And I don't appreciate the patronizing attitude of some posters.
>
> The pc in question is now clean.
> "Kerry Brown" <kerry@kdbNOSPAMsys-tems.c*a*m> wrote in message
> news:uaW$6fPEJHA.3288@TK2MSFTNGP03.phx.gbl...
>> You still don't seem to understand what everyone has been trying to tell
>> you. Once a system has been infected there is no way of knowing if it has
>> been cleaned/repaired except doing a full format and rebuild. You have
>> been able to fix the symptoms that you noticed. There may still be other
>> left over problems or the computer may still be infected.
>>
>> --
>> Kerry Brown
>> MS-MVP - Windows Desktop Experience: Systems Administration
>> http://www.vistahelp.ca/phpBB2/
>> http://vistahelpca.blogspot.com/
>>
>>
>> "Alan C" <nospam@noisp.com> wrote in message
>> news:%23Zn6XNNEJHA.1456@TK2MSFTNGP03.phx.gbl...
>>> For information and enlightenment:
>>>
>>> I fixed the problem, it turned out to be a winsock corruption.
>>>
>>> reinstalling tcp was the answer.
>>>
>>> "Alan C" <nospam@noisp.com> wrote in message
>>> news:uq4O1rAEJHA.1460@TK2MSFTNGP03.phx.gbl...
>>>> One XPPro workstn was infected by the antivirus 2008 trojan, which I
>>>> have managed to clean.
>>>> One problem remains: I cannot browse any server (2003) shares via
>>>> network places or explorer, although all mapped drives are accessible.
>>>> When I try to browse to the server, - '\\our_srv\' only one share is
>>>> shown - 'userdata' - and this appears as an empty folder.
>>>>
>>>> I know that the trojan affects the local policies, which I've reset,
>>>> but cannot find anything that would cause the above.
>>>>
>>>> Any help, suggestions, guidance would be gratefully received.
>>>>
>>>> P.S. I'm not sure if this is the correct ng. Hope it is.
>>>
>>
>