Softpanorama malware Defense Strategy

Restore process

• Introduction
• Create a full backup image of the infected partition
• Copy files that you updated since the create of the last image of C: drive to separate set of folders on your recovery USB drive (or other drive)
• Run your imaging program to restore the image of the C: partition from the backup
• Restore mail, bookmarks, cookies and other files that differ from the image

Introduction

Now you have an infected computer and you backup image of C-drive (hopefully not too outdated). Even if Windows is no longer bootable you still need first to recover files from the C-drive that are not on you image. The best way to do it is to create a full backup of inflected drive using Acronis or Ghost and then recover files from this image. This way you can be sure that you did not miss anything.

The key idea of Softpanorama restoration strategy is to boot Windows from the recovery partition of your USB drive and perform this process methodically without any rush. If you do not have recovery partition get a small USB drive (60G is enough) and restore your latest image of C drive to this drive first.

This way you can work without any rush: there are too many cases when important data were lost when people try to recover from infection and this is probably were the most damage from malware occures.

Booting from a recovery partition with a full copy of your C: partition from a bootable USB drive (or bootable partition on your large drive) gives you two advantages:

• Extra time to restore the infected drive: you can do most of your work with an older version of Windows that you booted. This additional ability of bootable UCB drive to alleviate the time pressure is extremely important for success of the restore operation. In my experience the most stupid and most damaging  "data destruction blunders" were done when I was under time pressure and need working computer "now".
   
• Extra flexibility on how you recover your data and restore the infected C: partition from the image.  For example you can repartition you drive into C-partiotion and datapartition which makes recovery simpler as you do not need to restore most of you data what are alreay in a separate, untouched by infection partitions.
  • availability of  this disk permits you to avoid  using the standalone loader of the imaging program for the restore operation. As you can read in Amazon review of Imaging program such as Ghost 15 and True Image this is Achilles part of any image creating program.
  • If you fail you still can use this bootable copy for some time and have time to simplify your setup and to prepare for a new attempt to restore the image without too much time pressure.

It is important that the clone of C-partition on this drive has your imaging program installed.  If accidentally it is not installed not, it is not that difficult to install it.

I would like to stress it again: standalone (bootable) restore utility is a weak spot of any Ghost-like utility, even if WinPE is used for restoration like in Ghome 14 and 15.

In case of True Image some extra work should done to make your restore configuration as transparent for True Image as possible. Minimal amount of drives should be connected. For example laptops should taken out of dock and USB drive should be connected directly to laptop port without any hubs. That increases the chances of success. But any program that relies on custom standalone loader works badly without Windows and that's a critical problem of this class of programs. I think this is an irresolvable problem, so you need to find a way to avoid it completely (see below). Fortunately, with cheap USB drives available now this is possible.

Create a full backup image of the infected partition

It is important to perform this step before trying to restore you C partition. Otherwise all files create since the last backup will be lost.

You can do it by booting from you recovery USB drive (recommended) or from Acronis recovery CD.

This is a very important step: Often in a rush people forget to copy some important files and restore the image on the drive destroying the file irrevocably.

Copy files that you updated since the creation of the last image of C: drive to separate set of folders on your recovery USB drive (or other drive)

The typical list includes:

• All data folders in you User directory:

  • My Document folder

  • My Music folder

  • ... ... ..

• Mail (if you are using Thunderbird you generally should move mail folder to another drive to avoid this step)

• Bookmarks

• Cookies

• Macros for programs like Arccrip

• Setting for Teraterm and like

• Address book if you use a separate program to keep it (for example Palm)

• Cygwin profile files if you use Cygwin

If the drive is unbootable you can read files by restoring infected image to additional USB drive and booting from you r USB drive with the "absolutely clean" copy of windows. You can also use any CD-based Linux distribution like Knoppix.

To automate the process you can also write a script that copies the folders that you are interested in to some predefined location.  Cygwin can be used for this purpose.

Run your imaging program to restore the image of the C: partition from the backup

Details depends on the program used. Again it is better to do it after booting from a USB drive will you recovery image. 

Restore mail, bookmarks, cookies and other files that differ from the image

This is the most important step and due to multiple location of files it is far from being trivial. It is better to write a small script that covers all your important location. Essntially the list of folders is that same as above. Try not to overwrite system files. 

Continued

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: January, 25, 2012