rootkit?

[John Summerfied]

Craig White wrote:


> ----
> Backing up data directories and reinstalling from scratch is the only
> known method to ensure the integrity of a system that has been
> compromised. Once a box has been compromised, you cannot trust a single
> binary file on the system.

You should go round telling every windows user that they need to 
reinstall after every virus attack. I think your advice would be more 
sound then, particularly wrt Windows 9x/Me.

There is some risk, sure, but if the object of cracking a machine is to
a) Provide a vehicle to attack others
b) Send spam
c) Provide a controlling machine to coordinate a and/or b,

then there is such a thing as too much control. The more harm an 
intruder does, the sooner it will be noticed.

Do you know a realistic, foolproof way to identify data directories? I 
don't: I think of my computers, and I can't see how you would reliably 
distinguish between data and non-data.


-- 

Cheers
John

-- spambait
1aaaaaaa at computerdatasafe.com.au  Z1aaaaaaa at computerdatasafe.com.au
Tourist pics http://portgeographe.environmentaldisasters.cds.merseine.nu/

do not reply off-list