Aware as I am, of the cracker-kits carried by Andrew and others, in the course of disinfection -- I recognize that the primary reason for all the Heroic efforts is about: somehow saving data, most-often for the fact of there having been no regular backups made. Obviously at some stage of manifold invasions: a full wipe is the sane alternative. But are any other measures best taken during / prior to a planned wipe?

ie - as it is clear that a repartitioning, reformat does not erase but a tiny fraction of the magnetic domains.. time permitting, I usually do a DOD diskwipe via gdisk. Am I missing something else?

Q: Disk editors are as old as disks; do we have any evidence of a resuscitation of a previous, complex invasion, now no longer in FAT (or disk index in the other formats): via a pattern search launched by a subsequent bug invasion? (This in the case where a specific IP address-range is being targetted, maybe repeatedly.)

Q-2: BIOS CMOS - given the special rewrite voltage drill, particularly for Flash: is there any known case of a rewrite to CMOS as might, in concert with above excavation - resurrect a call-home stub? (Since calls originating from within system appear to be generally less-well monitored than vice versa - even amongst the wary.)

Now I can appreciate that, given the variety of BIOS authors (though I note today - fewer and fewer?) these approaches may well be too iffy a plot, especially for any of the usual iggerant scripters-Class to bring off - but with the rise of Corporate funded malware, I wonder merely: is this Coming? (Also - I can't conceive of how any such dastardry could possibly be accessed - save perhaps nastiness to the MBR during boot / talking to a spawned redirect in the TCP stack?)

Q-gdisk: Anyone aware if gdisk can convert NTFS (or whatever Doze calls it) to FAT-32? (This whether or not one partition is later reconverted on Install, as in dual-boot machinations.) Unclear as I read the Symantec specs.

Lastly:
Given the plethora of services in -Home or -"Professional" Doze:
I note there are several Lists of suggested mode changes - from auto to manual or manual to disabled. And obv. a general script would need to have branches to accommodate use of whatever network / or none, etc.

Since youse gals n'guys no doubt roll your own for every specific box and its intended service, you can do so via daily familiarity with the non-ergonomic menus + any bitter past experience.

But among the plethora of self-proclaimed gurus Out There - has anyone a link or two for a recommended approach towards scripting of these hundreds of alterations needed - to run either of these toy OSs for more than (dozens of minutes) ?

For us amateurs, the list of dependencies is itself daunting, particularly in the made-up Fuzzy-faux-Friendly argot that Doze wallows in; it is difficult to assess the intended aim of lots of those lengthy silly-names. (Trying 'disabled' for effect: one-at-a-time seems a futile exercise, if the ultimately Safest one.)

Out-of-box is so obviously Billy-grade Stupid; surely by this time, there is something akin to universal agreement re many basic installations? (especially those as do not contemplate any Remote access at all, plan never to run a web site, nor need activated -- that plethora of Group descriptions, access permissions -- as surely confound the poor bastards trying to use AD to run some small bizness.)



(And since I haven't run down the drivers I'd need to wipe -Home from my otherwise nice notebook, I suppose {sigh} I've nothing to lose in an attempt to make that POS somehow Serviceable too, coincident with GRUB grokking. Hey.. this sucker now has 60 GB to waste! vs 1.2 on the poor old Tecra of yore.)

Not looking for a cookbook / too bloody much typing -- just a vetted link or two re some script-run formulas that have proven to be sane.


Gracias,
I


Ed: Q's.

Thanks, Scott - once again.

(I've installed XP via Restore - a couple times; working next on XP-Pro, with variant partition-sizes. She has - a half-dozen times - but not generic.)

Continuation of previous, yes. I'm taking it-all as Comedy though; am willing to kinda kibitz and guide "a dedicated party's" doing most of the tedious on-line sleuthing, assimilating, note-taking.

Meanwhile - I'm experimenting on the notebook (now undergoing a second repartitioning - to see if.. once merely partitioned -still NTFS- but Not reformatted via fdisk: my assigned Extended Partition space (for dual-boot, natch) shall not be auto-wiped by the single-minded Restore set / on This try.

Having seen the log printouts, I see the script Kiddie's methodical creation of groups, permissions, then closing off possible avenues of rectification: by setting Their PWs and accessibility (like 'Guest', for ex.). Lots of typing to create all those HKEYS - there simply has to be a comparable script for fixing a Wide-Open new install - - as follows a similar drill: for Defense.

(The world of computer users and fixers is an even more stupid-stupid place, if this obvious ploy re XP Hasn't been accomplished) - I must assume I just haven't found one yet, in whatever cockamamie Doze script-language is used for Corp mass-installs -- and then The TEMPLATE for this purpose.

And yes, I grok that every bug is an ap, is somewhere an .exe (starts with MZ) and is a sequence therefore, of bytes. Alex's link confirms that at least one BIOS bug reached circulation: that answers one of my queries. I'd have thought that such a virus would manifest during boot, alter MBR content (or at least interpretation) - but would need some stub hidden in Registry.?. or something like that.

A DOD-wiped, repartitioned HD Cannot contain disk-editor-accessible code for pattern-recognition by say, a subsequent (Part-II for Second Attack?) piece of nastiness -- that is what I supposed and still do.

(She can do an RR in sleep now - and my only denying force is waiting for #$^*%# fdisk to insist on a Diosk Test at every single step of repartitioning.)

Appreciate that a disk inventory via *nix would evade the interference with APIs that mask display of any file manager trying to operate in a diseased, well.. further-diseased than normal - Doze box. Not that agile yet w/ Linux.

I think if you're depending on being able to run update scripts before an unpatched, networked XP box gets infected or compromised, I think you're fighting a losing battle. The way to update a new XP install is to install the OS, install updates from a CD, and install an antivirus and antispyware package before it's hooked up to the Internet. At that point, you can turn off services, etc., before your friends start browsing the virus sites. :-)

Nope, we're following that sequence commencing with DL'd fixpacks, via Apple, yet! (surprised Beast would talk to an Apple..) - finding out next how to get cumulative patches (for all-at-once install.)

She was smart - paid real$ to get router setup properly and XP sanitized = 3 house calls; two after the invasion. They did none of the things right, even after two tries at unnecessary bug-fixing: it was already RRR'd! They wasted her time and $ (there was no data to be 'recovered'.) The evidence is there / documented. Court will be coming up unless reimbursement, also for a % of the pain/suffering. I wouldn't miss that show for anything - may post the terse opening allegation, excerpts from the appendix, rebuttal and evidence to be presented.

The 'script' I'm looking for is simply for lock-down;
this tedious task can use some automation (at least as efficiently as do the Kiddies - while undoing your barriers.) As for whether the gaggle of SpyBot clones find most-all .?. remember Post 198346 - Andrew's pretty detailed bug-hunt saga on a Vaio?

Then too, after this worm/trapdoor/whatever finished its methodical reconfig: SpyBot, AdAware would take all of a second to return "finished scan: OK". AVG flailed and died. I saw that on my infected notebook, before I wiped it. (I've also - earlier, elsewhere - seen ZA True Vector trashed.)

These are the reasons she is not relying on anything less than a careful litany of turn-offs AND all the usual nostrums AND double-firewall: ZA-Pro + Linksys buttoned down - with attacks, at each phase:

(ie. turn off router firewall! and hammer poor paraplegic XP, with only ZA to intervene. Pass that? Router back on. Test for "phoning-out" from within: is ZA doing its job of Alerts re inner activity? There are test-virii for this; are we having fun yet?)

Just maybe it will then run unscathed until the next New bug makes the rounds - gets in before the patches arrive: always days later. Wash, rinse. See? that's Why a script is needed:

When you expect this suppurating POS to go belly-up periodically - RRR is trivial compared with time for manually FIXING the out-of-box Experience. One More Time. That will be my attitude too, as I run Ex Pee on mine - (until I can find the 98 drivers.) But then, I'm on dialup: clearly less hazardous than her fire-hose hi-speed.

Anyway - it's fun so far, though it takes time away from the *nix Project and those other things in Real life.. Just a variant on NY Times Saturday Crossword :-)


Cheers,
moi

Also thinking simplistically:
OSX ergo any *nix, I suppose (and maybe <= OS9??) natively grok FAT, as I have seen with own baby blues. Handy for getting Beastware data off, obv. Unaware if M$ NTSF (undoubtedly 'customised-to-noncompliance') -- plays nearly as nicely (?) Yeah.. ignorance produces fuzzy decisions.

And in practice, in this case re the convenient use of fdisk or gdisk:
I expected later, on *nix install in those Extended Partitions, to reformat to an appropriate selection (at which point I would have to learn if Reiserfs / 'journalling' are buzzwords a non-db-using Admin needs to concern pretty little head about.)

Thanks for reminder, but I had not totally missed the archaic nature of FAT, its limited menu of attributes for precisely-graded security AND its crutch of regular defragging -- thus, wonder if the M$ + Symantec co-prosperity-sphere assured that NTSF would need defragging [Tool$] too? (Surely a corporate pact worthy of both.)

Ashton

Does that imply --> to do sneakernet, one needs to save a small partition formatted in FAT, xfer data there: then it's accessible via those handy little buggers?

It's the missing half of Greg's terse comment :-)

(ie formatting one of those dongles in other-than FAT - if even possible - would be counterproductive)