Text 13912, 88 rader
Skriven 2010-01-29 09:28:36 av Ross Cassell (1:123/456)
  Kommentar till text 13910 av TIM RICHARDSON (1:123/140)
Ärende: my future's so bright i h
=================================
Hello TIM!

29 Jan 10 06:10, you wrote to me:

 TR> The first week went fine. The second week he gives me a CD with some
 TR> stuff on it he got from the InterNet, one of which I wanted (Total
 TR> Commander). The minute I put that CD into the drive, a Windows warning
 TR> came up telling me something was on the CD that was trying to write to
 TR> my Registry. I pulled the CD out, ran a scan and got Windows to remove
 TR> a couple of small files that had written themselves, and everything
 TR> was fine.

Windows malware is nasty and has borrowed a page from the viruses of the DOS
days. Some DOS malware would have a process resident in memory and would detect
when a disk was inserted into the flopy drive, if one was, it would write to
the disk, so that the disk would contain a copy of itself and hopefully be
spread to another system.

Many malware agents for windows, now do the same whenever flash drives are
inserted.

The danger is worse here as many windows systems are set to autorun the
contents of inserted removeable media, denoted by the commands contained within
a file called autorun.inf. autorun.inf on optical media is usefull for
launching the install or setup utility for an application or if on a flash
drive, start up if so equipped, the U3 program.

At work, I use flash drives to install malware scanners, service packs or other
updates for customer computers that have come in for virus removal. One day my
co-worker asks me for my flash drive, to install a service pack for a computer
he was working on, he inserted it long enough to copy it over, but it was long
enough to have had that customers nasty bug copy itself onto my drive, but I
didnt know it at the time.

That night I was updating the drive, and sure enough, when I inserted it into
one of my machines here at home, autorun came up and stuff tried to install,
fortunately my defenses on the machines were stout enough to have stopped it.
but I still rebooted into safe mode and did a full scan with Malwarebytes.

As a result, I turn off autorun for any removeable media, a setting that is
done with the Windows Group Policy Editor.

I also employ other contingencies..

I carry 4 flash drives, all of which have all of there remaining free space
consumed by a dummy file.

2 of the four, have a physical write protect switch, which is toggled to read
only.

1 is bitlocker encrypted making it read only on XP and Vista machines.

 TR> My friend in the meantime, is having all sorts of problems with his
 TR> `self- built' machine, and he finally had to toss it all and buy
 TR> himself a new computer.

All he had to do is buy a legal copy of the OS, or go free and get Linux.. :)

 TR>  But before it was over and he bought the new
 TR> system, he'd ploughed almost $500 into his self-built machine, over
 TR> and above what he'd spent for the equipment in the first place, only
 TR> to find out that the classes he paid around $300 or more to take,
 TR> taught him just about enough to get him into trouble, and cost him a
 TR> bunch of money!

Like going to Harvard Law School makes one automatically a good Lawyer because
of the schools name on the degree..

 TR> Computers are like cars.....a person can change their own oil and
 TR> filters, clean and regap the plugs and points without a whole lot of
 TR> mechanical knowledge.

 TR> But yanking off the heads and doing a ring and valve job without some
 TR> pretty in-depth knowledge of what you're doing, is best left to the
 TR> experts.

Yup..

The best way to learn computers is one step at a time, learn by doing, thats
how I did it.

==
Ross
Fidonet Feeds Or Fidonet In Your Newsreader: http://www.easternstar.info
E-mail: ross(at)cassell(dot)us | Other Places: http://links.cassell.us
... Real Critical Thinkers Never See the Inside Of A Jail Cell!
--- GoldED+/LNX 1.1.5-b20060121
 * Origin: The Eastern Star - Spartanburg, SC USA (1:123/456)