2

Possible Duplicate:
Updating Malware cleaning skills

I was having an argument the other day regarding damaged systems. If a system has a hard to eradicate virus, etc, or has been damaged by a software install, etc, do you advocate rebuilding the system or trying to repair it?

Community
  • 1
Robot
  • 337
  • 1
  • 3
  • 8
  • This has been asked and answered on here a half-dozen times already – MDMarra Mar 04 '10 at 12:35
  • 6
    @MarkM, Agreed. Nevertheless, rebuild, rebuild, rebuild. You can never be sure you've repaired everything. Plus you get to test your backup policy as part of the rebuild. – jscott Mar 04 '10 at 12:51
  • @MarkM, can you provide links to the threads you feel are definitive? That would help, thanks. – Robot Mar 04 '10 at 13:09
  • http://serverfault.com/questions/27708/updating-malware-cleaning-skills/27709#27709 http://serverfault.com/questions/5852/how-do-you-deal-with-malware-on-windows are two big ones. The general consensus is to just reimage the affected machines. – MDMarra Mar 04 '10 at 14:54

3 Answers3

2

It's subjective, since it depends on a number of factors, but the majority of the time if you're paying someone to do it it's most cost effective (for time) to just wipe and reinstall.

The only time I find it's worth a while to try fixing it (and you can never trust it fully since it might have something hidden as a rootkit or in alternate file streams, etc...) is if you're curious enough to spend days eradicating the problem as an intellectual exercise, or the computer has very proprietary and specialized configurations of software that are very particular to a particular user.

Today it's just too commodity to spend more than a few hours on repairing a system. Today home computers are so cheap for what most users do that even if a shop charges thirty or forty bucks an hour to fix systems it'll cost more to repair it than to just buy a new CPU.

Bart Silverstrim
  • 31,092
  • 9
  • 65
  • 87
1

I find that if I cannot fix a problem in 30 minutes (at work) unless it is a service pack install, check disk or other routine process than the system gets re-loaded. 90% of the systems I work on have multiple backups of data or are "dumb" clients and easy to wipe. It takes much less time to reload the machine than it does to troubleshoot the problem.

Best thing you could do is backup your data to an external hard drive enclosure not on your network if it has a virus. Then wipe and re-load the system and move back your files from the external drive. This way if it is a virus or something nasty like that it does not have any chance to infect the rest of the network.

DanielJay
  • 265
  • 2
  • 5
  • 13
  • One problem with backups is that if users are backing up executable programs or code, it may spread the infection if it's a virus issue. Saving data like documents or movies should be safer, or using filesystems that aren't NTFS with alternate file streams, can help save data. Taking system snapshots as a backup are great for restore but can also back up the virus (as can saving your browsing history, email caching, etc.)...then you reinfect the system :-( – Bart Silverstrim Mar 04 '10 at 14:05
  • Wow that didn't quite sound like I am awake enough to be commenting, didn't it? – Bart Silverstrim Mar 04 '10 at 14:05
  • Documents aren't as safe as they used to be, back when I was a young man wrestling saber-toothed tigers to get to the keyboard. There's executable content (VBA, Javascript, whatever) in a lot more places than you'd think at first. – David Thornley Mar 04 '10 at 15:09
  • @Bart Silverstrim I agree with you about snapshots / backing up executable programs not the best. I should have made myself clearer about sticky with documents and multimedia. Might even be able to include database files for applications that use their own flat file type database but not the entire application. Re-installing the os and all applications, then transferring back documents seems like best way to do things. – DanielJay Mar 04 '10 at 20:22
1

I have worked at a few companies where company policy is wipe clean whenever a virus is encountered. To the point where your machine is not allowed back on until it is wiped.

boezo
  • 401
  • 2
  • 3