reoccuring viruses

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my =
coat and leave.

Don't worry, we will forgive you.

Zee




"Mike M" wrote in message =
...
If you think that Symantec know what they are talking about they might =
not=20
be the company that has done most to destroy users' systems in the =
last=20
ten years than any others. As for system restore Symantec are totally =

clueless otherwise they would have fixed both NAV and LiveUpdate so =
that=20
they don't crap out when system restore is used.
=20
So yes, stupid and clueless are a pretty good description of your=20
contribution to this thread. Sorry but if the truth hurts maybe it =
will=20
prompt you to think about your posts in future - something you clearly =

haven't done to date.
--=20
Mike Maltby MS-MVP

=20
=20
oops!! wrote:
=20
Asinine...

One in sooooo.... many:
=
http://securityresponse.symantec.com...beagle.ba@mm.=
html
...
The following instructions pertain to all current and recent =
Symantec
antivirus products, including the Symantec AntiVirus and Norton
AntiVirus product lines.

1. Disable System Restore (Windows Me/XP).
2. Update the virus definitions.
3. Restart the computer in Safe mode or VGA mode.
4. Run a full system scan and delete all the files detected as
W32.Beagle.BA@mm.
5. Delete the value that was added to the registry.

For specific details on each of these steps, read the following
instructions.
...

Stupid...

Jim Byrd..??

Defending Your Machine
http://defendingyourmachine.blogspot.com/
...
Disable Restore if you're on XP or ME (directions he
http://vil.nai.com/vil/SystemHelpDoc...SysRestore.htm), then
boot to Safe mode or a Clean Boot as above (HowTo he
=
http://service1.symantec.com/SUPPORT...1052409420406=
)
Read tscreadme.txt carefully, then do a complete scan of your system
and clean or delete anything it finds...

Hmm...

Shall I go on?

No, no need.

Cheers,

Zee





"Mike M" wrote in message
...
Common on practice is not BEST practice. This is a perfect example
of very bad advice and something not countenanced by anyone who has
given the subject any thought whatsoever.

I'm sorry but it is totally asinine to disable system restore until
the system is back up and running OK and to advise otherwise is
simply bad if not also stupid however well intentioned.

As for the LSPfix, I know perfectly well how to obtain this thanks
(it was me that mentioned it) but spare a thought to the individual
who knows nothing about winsock problems, LSPfix or where to get it
and follows your advice. They disable system restore, run their
marvellous cleaning tool and end up with a system unable to connect
to the net. They're now helpless and not even able to use their PC
to ask for help. If however they had not disabled system restore
all they need to do is to roll their system back, connect to the =
net
and ask for advice.

So to conclude, disabling system restore prior to cleaning is
nothing more than VERY BAD ADVICE.
--
Mike Maltby MS-MVP



oops!! wrote:

Mike,

I am sorry but common practise nowadays is turning off system
restore before scanning and cleanup.

If you leave system restore on, many of the latest nasty intruders
will immediately restore upon the first reboot.

This applies to WinME as well as to WinXP.

Regarding winsock corruption, it's also generally suggested to
download the fixing tool before cleaning.

I always suggest this winsock fix by Option^Explicit (compatible
with Win95, 98, Me, 2000 and XP):

http://downloads.subratam.org/WinsockFix.zip

Anyway, this has been working for me this way, and you will see it
recommended in most, if not all, forums on the subject.=20

Mike,

Are you sure you're not an impostor?

Sensing a bit of trolling.

Zee




"Mike M" wrote in message =
...
The lack of education and understanding is on your part. Sadly you =
appear=20
only too willing to share that lack of understanding and ignorance =
with=20
others. From your post you are clearly clueless about system restore =
and=20
what is good and bad practice.
--=20
Mike Maltby MS-MVP

=20
=20
oops!! wrote:
=20
Mike,

LOL

I'm sure your *wisdom* is proportional to your lack of education and
good sense.

But, that's so typical of too many MVP's.

Enjoy your life, mate.

I feel that it is yourself that is the troll in this thread. Hopefully
you'll come to your senses and think about what you are saying and see the
light. At least when you do you will be in front of Symantec. :-)
--
Mike Maltby MS-MVP



oops!! wrote:

Mike,

Are you sure you're not an impostor?

Sensing a bit of trolling.

Come on, Zee! - You know Mike's right.

It *may* be "Common Practice" - condoned only by those who have never
thought Mike's argument thru' - but surely "Best Practice" is to keep all
your options available.

Every time I've seen Mike offer this advice (which are many!), he has ALWAYS
warned of the dangers of selecting the wrong SR point - which is basically
only what Symantec are hinting at in their blurb, but not explaining. A
vague :-
"... System Restore has the potential of restoring an infected file on your
computer, even after you have cleaned the infected files from all the other
locations."
seems to be your (and their) only justification.


Sorry Zee, but Symantec's case does not appear to offer any other "hard
evidence" for disabling SR, for this issue to become "Best Practice"

If you are so paranoid about re-introducing the virus "yourself" - through
neglect, or is that Bad Practice! - then surely the solution is to flush
System Restore *AFTER* clearing the problem - or better still, adjust the
size of SR until you've FIFO'd the virus away. After all, it is quite
harmless whilst it's still in the _SR folder - 'finger trouble' excepted g

As one who has benefited from using Mike's method (on more than one
occasion!), I'm sticking with his argument - no forgiveness required!

I'm not an MVP, but a strong advocate of SR - IMHO, SR is a grossly
under-used, under-promoted and mis-understood utility)

Mart


"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my coat
and leave.

Don't worry, we will forgive you.

Zee

snipped

For just a moment, listen to what others are attempting to tell you......

1)System Restore is a way to get you back to a point at which the system
operated enough for SR itself to work (if nothing else!)
2) switching off System Restore removes the ability to Restore your system
back even 5 minutes - let alone perhaps 5 days (or even 5 months!)
3) when running an AV, you may be performing major heart surgery on your
PC - are you prepared to do that without any modern cardiac devices to hand?
4) SR isn't perfect - and never will be - but it IS possibly the only thing
that may enable a user with a broken heart to restart the heart for long
enough to save his all-important data before deciding to go for the 3-day
event of reinstall/resurrection.
5) Norton software is the single greatest contributor to the problems
brought to these newsgroups for Windows ME, and the other similar groups out
on UseNet - and they still deny any responsibility for any problems that
their viruses(sorry - programs) cause to users of whatever operating system
it's installed into (despite the fact that they partially admit that it has
problems, simply because they provide - if you're patient enough to search
deep enough in their archives - removal programs that go some way to
removing the crap that they install in the first place). If you choose to
believe these inept idiots, then that's your choice - but DON'T, please,
mislead the newcomers to these groups by attempting to proclaim Symantec's
brilliance in technology - the only thing that they are good at is
Marketing, and the shine may be beginning to wear off that as well, as more
and more people learn the depth of the deception which the company is
perpetrating.

There has never yet, to my knowledge, been a visitor from Symantec to these
newsgroups - even purveyors of spyware such as NewDotNet occasionally poke
their heads above the parapet to defend their practices, but Symantec has
been (suspiciously?) silent, despite the opprobrium which is daily heaped
upon their corporate head.


Yes , there are MVP's who recommend inappropriate practices with System
Restore - and Mike, myself and others are discussing this subject with them
elsewhere, in an effort to iron out the disagreements. What you will find,
though, is that MVP's from the Operating System background - i.e "Windows -
Shell/User", as it's now called - are almost unanimous in their opinion that
SR should NOT be disabled until the system is again stable after the
cleaning effort. Almost all the dissenting voices are not specialist in the
Operating Systems involved, and their experience in the end-user area is
often minimal, as they may well be very oriented towards server/client
solutions.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

As far as I can see the only forgiving to be done is in the reverse order of
where you think it needs to be done.

--
Richard G. Harper [MVP Shell/User]
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my coat
and leave.

Don't worry, we will forgive you.

Noel,

I've read through your post basically because you're not screaming and with
the respect you deserve as a proficient poster in the ME-related
NG's.

I am sorry but some of the posts in this thread are unworthy of you or Mike.

One point I must clear, I am NOT defending Symantec/Norton in any way, and
I'm surprised you can't remember some of my comments on that. But, never
mind.

That was a simple quote, but as you know I could point you somewhere else:

http://www.pchell.com/virus/systemrestore.shtml
http://www.trendmicro.com/en/securit...n_me_clean.htm
http://www.pcmag.com/article2/0,1759,1618204,00.asp

Point 1 to 4: I am 100% pro-SR. I only claim, and will until proved wrong,
that SR should be turned off BEFORE cleaning the system.

Point 5: gave me a good laugh. I don't differ too much.

Point 6: MVP's disagreements. Of course they do as normal people do, but the
fact of you or Mike being on one of the sides of discussion don't make you
the right choice. I am on the other side as you may have noticed.

And as a final comment Noel, thank you for posting your thoughts.

Zee




"Noel Paton" wrote in message
...
For just a moment, listen to what others are attempting to tell you......

1)System Restore is a way to get you back to a point at which the system
operated enough for SR itself to work (if nothing else!)
2) switching off System Restore removes the ability to Restore your system
back even 5 minutes - let alone perhaps 5 days (or even 5 months!)
3) when running an AV, you may be performing major heart surgery on your
PC - are you prepared to do that without any modern cardiac devices to
hand?
4) SR isn't perfect - and never will be - but it IS possibly the only
thing
that may enable a user with a broken heart to restart the heart for long
enough to save his all-important data before deciding to go for the 3-day
event of reinstall/resurrection.
5) Norton software is the single greatest contributor to the problems
brought to these newsgroups for Windows ME, and the other similar groups
out
on UseNet - and they still deny any responsibility for any problems that
their viruses(sorry - programs) cause to users of whatever operating
system
it's installed into (despite the fact that they partially admit that it
has
problems, simply because they provide - if you're patient enough to
search
deep enough in their archives - removal programs that go some way to
removing the crap that they install in the first place). If you choose to
believe these inept idiots, then that's your choice - but DON'T, please,
mislead the newcomers to these groups by attempting to proclaim Symantec's
brilliance in technology - the only thing that they are good at is
Marketing, and the shine may be beginning to wear off that as well, as
more
and more people learn the depth of the deception which the company is
perpetrating.

There has never yet, to my knowledge, been a visitor from Symantec to
these
newsgroups - even purveyors of spyware such as NewDotNet occasionally poke
their heads above the parapet to defend their practices, but Symantec has
been (suspiciously?) silent, despite the opprobrium which is daily heaped
upon their corporate head.


Yes , there are MVP's who recommend inappropriate practices with System
Restore - and Mike, myself and others are discussing this subject with
them
elsewhere, in an effort to iron out the disagreements. What you will find,
though, is that MVP's from the Operating System background - i.e
"Windows -
Shell/User", as it's now called - are almost unanimous in their opinion
that
SR should NOT be disabled until the system is again stable after the
cleaning effort. Almost all the dissenting voices are not specialist in
the
Operating Systems involved, and their experience in the end-user area is
often minimal, as they may well be very oriented towards server/client
solutions.

--
Noel Paton (MS-MVP 2002-2005, Windows)

Nil Carborundum Illegitemi
http://www.btinternet.com/~winnoel/millsrpch.htm
http://tinyurl.com/6oztj

Please read http://dts-l.org/goodpost.htm on how to post messages to NG's

"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Mart,

Thank you for your comments.

1. Mike is not right, and SR should be turned off BEFORE cleaning the
system.

2. I am 100% pro-SR.

3. Quoting Symamtec doesn't make me their defence lawyer, or whatever.

4. You will see in some of my posts I said Mike is one of the best, if not
the best, around. That doesn't make him faultless.

As you may see from other posts there are MVP's that think differently too.

Thank you again and take care.

Zee




"Mart" wrote in message
...
Come on, Zee! - You know Mike's right.

It *may* be "Common Practice" - condoned only by those who have never
thought Mike's argument thru' - but surely "Best Practice" is to keep all
your options available.

Every time I've seen Mike offer this advice (which are many!), he has
ALWAYS
warned of the dangers of selecting the wrong SR point - which is basically
only what Symantec are hinting at in their blurb, but not explaining. A
vague :-
"... System Restore has the potential of restoring an infected file on
your
computer, even after you have cleaned the infected files from all the
other
locations."
seems to be your (and their) only justification.


Sorry Zee, but Symantec's case does not appear to offer any other "hard
evidence" for disabling SR, for this issue to become "Best Practice"

If you are so paranoid about re-introducing the virus "yourself" - through
neglect, or is that Bad Practice! - then surely the solution is to flush
System Restore *AFTER* clearing the problem - or better still, adjust the
size of SR until you've FIFO'd the virus away. After all, it is quite
harmless whilst it's still in the _SR folder - 'finger trouble' excepted
g

As one who has benefited from using Mike's method (on more than one
occasion!), I'm sticking with his argument - no forgiveness required!

I'm not an MVP, but a strong advocate of SR - IMHO, SR is a grossly
under-used, under-promoted and mis-understood utility)

Mart


"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my
coat
and leave.

Don't worry, we will forgive you.

Zee

snipped

Typically, we should have at least 5 or 6 "MVP's" more posting in defence of
the pack.

How is it possible you fail to see how sad that is?

Zee





"Richard G. Harper" wrote in message
...
As far as I can see the only forgiving to be done is in the reverse order
of
where you think it needs to be done.

--
Richard G. Harper [MVP Shell/User]
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my
coat
and leave.

Don't worry, we will forgive you.

Oops, I forgot you're a bit short sighted too.



"Richard G. Harper" wrote in message
...
As far as I can see the only forgiving to be done is in the reverse order
of
where you think it needs to be done.

--
Richard G. Harper [MVP Shell/User]
* PLEASE post all messages and replies in the newsgroups
* for the benefit of all. Private mail is usually not replied to.
* My website, such as it is ... http://rgharper.mvps.org/
* HELP us help YOU ... http://www.dts-l.org/goodpost.htm


"oops!!" wrote in message
...

Mike,

Just thought about it... you're right...

Everyone else is wrong...

Even other MVP's...?? You got it a notch higher than expected!

Oh, yes I'm so embarrassed for embarrassing you that I'll just take my
coat
and leave.

Don't worry, we will forgive you.