• Tracking down the details on malware

    Home » Forums » Newsletter and Homepage topics » Tracking down the details on malware

    Author
    Topic
    #489338


    LANGALIST PLUS


    Tracking down the details on malware

    By Fred Langa

    After finding — and curing — Alureon and Blacole malware infections, a reader wonders where to find authoritative information. Plus: Options for simple disc imaging with a boot disk, a do-it-yourself recovery disc, a Spinrite update, and a different way to add a Start button and menu to Win8.

    The full text of this column is posted at windowssecrets.com/langalist-plus/tracking-down-the-details-on-malware/ (paid content, opens in a new window/tab).

    Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.[/td]

    [/tr][/tbl]

    Viewing 2 reply threads
    Author
    Replies
    • #1393522

      I have been reading your posts about disk imaging with much interest. I have some problems that you and others do not seem to have covered.

      Concerning the use of Windows Backup an Restore, I have not found a way to keep more than one system image. I would like to keep at least two. Also when I create a system repair disk to a CD, It will not boot. The original install disk will boot and the system image is visible.

      I suspect that the booting problem using the system repair disk is associated with my BIOS settings. My MB is a GA-Z77x-UD5H which has American Megatrends F14 bios.

      I have tried Paragon Backup and Restore and their recovery disk will not function either. When I load the Paragon recovery disk, none of my hard drives are visible.

      The problem is that the linux they use does not have drivers for the Z77 chip. My disks are currently configured as two sets of RAID 1. I plan in the near future do add an SSD and reconfigure my hard disks to RAID 5.

      I have contacted Paragon about this problem and was told that the free version will not support the Z77. They said that if I pay for their full version, maybe the Z77 drivers can be added to their WinPE distribution. I would like to be sure before I spend the money.

      Suggestions?

      rec

    • #1393526

      Rec:
      Authors do not ofter reply to questions/problems posted in this section.
      I suggest you post your query over in the “Maintenance” section of the Lounge.
      Dick

    • #1393548

      SpinRite
      Is in dire need of an update by Steve G.

      But the work-around for a SATA drive in AHCI mode would be to boot to BIOS first, change AHCI to IDE, then boot directly to SpinRite.
      When you are done, boot directly back into BIOS and reverse the mode. (don’t boot to the desktop without changing back first)
      WARNING
      Some may have serious issues doing this.

      Disk Imaging
      Macrium offers a great little USB boot disk tutorial that can be either Linux based and or WinPE.
      Creating it is simple, see here.

      • #1393886

        Re Spinrite: The reader’s report of problems with Spinrite and SATA drives that Fred quotes leaves a misleading impression, suggesting that Spinrite won’t work on SATA drives. Not so. My office IT tech, who raves about Spinrite for recovering apparently dead hard drives, tells me he has never used Spinrite on anything but SATA drives, and the Windows 7 operating system should make no difference since Spinrite boots a different operating system. CLiNT’s postings above and in January (http://windowssecrets.com/forums/showthread//151772-SpinRite-won-t-run-on-win7-64) indicate that the problem is only on new systems with AHCI mode. DrWho’s posting in January also says Spinrite works fine for him on SATA drives.

        I think it would be very helpful if Fred would write this up for all readers, explaining what AHCI mode is, how you figure out if your computer has it, and what the potential problems are with temporarily changing AHCI to IDE. It would be a shame if readers were misled to think they can’t use Spinrite on any SATA drives until it’s updated.

        • #1395170

          Regarding Acronis disk imaging software:

          I happily used and recommended Acronis for several years. I purchased it to use its scheduling function to do full backups from a small data server running Windows XP to different network drives on different nights of the week.

          This worked reliably until about two years ago, apparently a Windows XP update broke the functionality. The software would begin the backup, get some percentage done, and then report a write failure and terminate the operation. Days and days of forum searches and attempts to fix the problem using suggestions on the forums failed to give me enough information to fix the problem. Furthermore, their own forum was rife with complaints about the issue, with extremely sparse canned responses from tech support, and sometimes outright snide responses from the company itself. There were reports of people buying upgrades to the latest version in their attempt to fix the issue, and failing.

          In the meantime, I built another machine and programmed it to back up the hard drive using another method, but that method still didn’t give the multiple days of fall-back needed in case a corrupted database got saved onto the backup, writing over the last good copy before it was discovered. In other words, if you went home and came in the next morning to find your accounting database file corrupted, the corrupted file would be in the backup image too.

          I revisited the issue a few months ago, only to discover that those who are unlucky enough to be afflicted with this problem still have no solution, and none promised, in fact no substantive response on the issue at all.

          Rather than purchase the upgrade on the chance that it might work, and based on the overwhelming consensus about their tech support (apparently tech support is sympathetic but is kept away from engineering because they can’t get any better answers than you can) I went shopping.

          I settled on Terabyte Image for DOS/Linux and Windows. It is not so much of a one-button solution and depending on your needs might require some reading of the fine manual, but it is capable of doing the things that the old version of Acronis did. The Windows version has a scheduler in it that allows me to write a backup to a different network drive on different days. It will allow me to do a bare-metal restore onto any replacement drive that is big enough to hold the archive, from an image stored on the network using a boot disk. The boot disks can boot any machine and use DOS or Linux to do back-up and restore to any attached drive. In my tests it was reliable (I’ve come this far by having disk failures and having two different backup solutions in years past fail to restore from the archive, now that is very frustrating).

          Just a word to the wise. Using Acronis is like signing up for an ISP. If everything works for you, it’s great. If something doesn’t work, you’re in for a new kind of adventure. Always test extensively before you commit, keeping in mind the cost for loss of data.

    Viewing 2 reply threads
    Reply To: Tracking down the details on malware

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: