M$ Says Recovery from Malware Becoming Impossible Options

[dauss]

http://www.eweek.com/article2/0,1895,1945808,00.asp

LAKE BUENA VISTA, Fla.—In a rare discussion about the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Offensive rootkits, which are used hide malware programs and maintain an undetectable presence on an infected machine, have become the weapon of choice for virus and spyware writers and, because they often use kernel hooks to avoid detection, Danseglio said IT administrators may never know if all traces of a rootkit have been successfully removed.

He cited a recent instance where an unnamed branch of the U.S. government struggled with malware infestations on more than 2,000 client machines. "In that case, it was so severe that trying to recover was meaningless. They did not have an automated process to wipe and rebuild the systems, so it became a burden. They had to design a process real fast," Danseglio added.

Danseglio, who delivered two separate presentations at the conference—one on threats and countermeasures to defend against malware infestations in Windows, and the other on the frightening world on Windows rootkits—said anti-virus software is getting better at detecting and removing the latest threats, but for some sophisticated forms of malware, he conceded that the cleanup process is "just way too hard."

.....

[Dogmeat]

You aren't getting the point as I've said repeatedly.

Doing one machine, a few - no biggie.


Doing All of your machines for a truly clean slate, that's what I've been talking about since the first post

When I quit my last network admin job, before I went back to college, I was in the process of setting it up to where if we did ever have a mass failure (remember when the US plane went down in China in 2000 and there was a mass chineese assault on everything ending in .gov?) that we had semi-automated norton ghost bootdisks that would restore machines long-distance over the network, and then scripts set up so that upon the first user login all they'd have to do is literally enter a few things in, and the base computer would be exactly how it was when they first had it...

I never actually had a chance to perfect this, because it never happened, but I was in the process of working on it when I quit....

I can see where on a large scale this would be a nightmare, but testing and planning would go a long way in easing that. I still find it funny the lowly dork from Wyoming was doing this shit half a decade ago while working a measly state IT job and yet just now microsoft is saying "oh yeah you guys gotta like, do this" ....

heh