Is MBAM is a 100% safe application?

[Dustin Cook]

~BD~ <BoaterDave@hot.mail.co.uk> wrote in
news:7ridndLhg8MJXkfWnZ2dnUVZ8rqdnZ2d@bt.com:

> David H. Lipman wrote:
>> From: "David H. Lipman"<DLipman~nospam~@Verizon.Net>
>>
>> | From: "~BD~"<BoaterDave@hot.mail.co.uk>
>>
>> | FUD post !
>>
>> | There is NO malware that infects are resides within the; BIOS,
>> | Motherboard or Video-card
>> | EEPROM.
>>
>>
>> That should have been...
>> "...that infects or resides within..."
>>
>>
>>
> So now we are in a situation where someone (drdos) has posted
> information on a well known technical forum saying one thing .......
> and Mr David H Lipman (whoever he may *really* be!) making a post on
> Usenet groups claiming that the original poster is wrong.

If the article claims an infection in the bios or eeprom vs corruption;
then the article is indeed, wrong. BD.

> Take a step outside the box, David.

Google bios and eeproms David. You might find it somewhat enlightening.

> How could anyone simply 'visiting' these groups have any notion of who
> is actually telling the truth?

By doing their own research into the matter?

> I am /inclined/ to believe what *you* say - but there is no supporting
> evidence to that effect - is there?

See above. Google really is your friend.

> Is it reasonable for readers to accept that, as you have made no
> disparaging comment to the contrary, that "Most wiping, erasing,
> formatting, and partitioning tools will not overwrite logical bad
> sectors on the Disk, leaving the Rootkits and their accompanying
> payload of malware behind and still active."?

behind, possibly; active.. no.

> If so, what action would one recommend one takes before reinstalling
> an operating system on a previously used disk - Darik's Boot and Nuke?
> http://download.cnet.com/Darik-s-Boo...-DVD/3000-2094
> _4-10151762.html

If it does sector overwrites (and I believe it can be configured to do
so) yes.

> Or, maybe FDISK will do? http://support.microsoft.com/kb/255867

FDISK is a partitioning tool. it doesn't address sectors marked as bad.

> Or does one simply assume that one's disk is Rootkit free and simply
> use a Windows set-up disk and the in-built formatting facility?

If the system disc is clean and initializes the bootsector with clean
code, bye bye rootkit. Assuming it was an MBR based one.


--
"Hrrngh! Someday I'm going to hurl this...er...roll this...hrrngh.. nudge
this boulder right down a cliff." - Goblin Warrior

[~BD~]

Dustin Cook wrote:
>
> If the article claims an infection in the bios or eeprom vs corruption;
> then the article is indeed, wrong. BD.

Thank you, Dustin.

>> Take a step outside the box, David.
>
> Google bios and eeproms David. You might find it somewhat enlightening.

I've done much research!

>> How could anyone simply 'visiting' these groups have any notion of who
>> is actually telling the truth?
>
> By doing their own research into the matter?

On Usenet there is absolutely no way of telling who is telling the truth
AFAICT. I know much about you and, in spite of what you may think I
thought (!) I'm quite sure that you a real young man with a mom and a
family.

I know absolutely *nothing* about David H. Lipman, save for the fact
that he thinks he is God's gift to Usenet and is a contributor at
Malwarebytes forums. His English is poor and he has little understanding
of human nature.

>> I am /inclined/ to believe what *you* say - but there is no supporting
>> evidence to that effect - is there?
>
> See above. Google really is your friend.

I find nothing about the personal/professional life of Mr Lipman.

Quote:

1. The "False Authority Syndrome"

Don't believe everything. Some people talk or write about viruses as if
they were an authority in this field, but in fact they are often not.

Ref: http://www.claymania.com/info-fas.html


>> Is it reasonable for readers to accept that, as you have made no
>> disparaging comment to the contrary, that "Most wiping, erasing,
>> formatting, and partitioning tools will not overwrite logical bad
>> sectors on the Disk, leaving the Rootkits and their accompanying
>> payload of malware behind and still active."?
>
> behind, possibly; active.. no.

OK - possible to be reactivated once back on-line?

>> If so, what action would one recommend one takes before reinstalling
>> an operating system on a previously used disk - Darik's Boot and Nuke?
>> http://download.cnet.com/Darik-s-Boo...-DVD/3000-2094
>> _4-10151762.html
>
> If it does sector overwrites (and I believe it can be configured to do
> so) yes.

That was my understanding. Thanks.


>> Or, maybe FDISK will do? http://support.microsoft.com/kb/255867
>
> FDISK is a partitioning tool. it doesn't address sectors marked as bad.

At that link it says - quote:-

"When you run the fdisk command to create, delete, or change a
partition, all of the data on that partition is permanently deleted".

I've always understood that to mean that any malware would be destroyed
too!

>> Or does one simply assume that one's disk is Rootkit free and simply
>> use a Windows set-up disk and the in-built formatting facility?
>
> If the system disc is clean

How can one be sure that it *is* clean?!!!

> and initializes the bootsector with clean
> code, bye bye rootkit. Assuming it was an MBR based one.

That is my understanding too. My niggling concern has always been that
malware (call it what you will) might remain 'somewhere' within a box
ready to continue with it's malicious activity even though it's been
flattened and windows reinstalled (or even if a *new* hard disk has been
installed!).

I suspect such thoughts came about from my contact and discussion with
our then High Tech Crime Unit - who recommended that I *destroy/trash*
the machine involved in my identity theft encounter. The implication was
that there is much more going on 'behind the scenes'- things that the
authorities do not want the public to know about!

As I'm sure you have gathered, I prefer honesty and openness!

--
Dave

[Ant]

"~BD~" wrote:
> 1. The "False Authority Syndrome"
>
> Don't believe everything. Some people talk or write about viruses as if
> they were an authority in this field, but in fact they are often not.
>
> Ref: http://www.claymania.com/info-fas.html

The link to vmyths (for more about FAS) on that page is out of date.
Use this: http://vmyths.com/fas/ which redirects to a PDF written by
Rob Rosenberger. It's a bit dated now, talking about old msdos viruses
and bulletin boards, but the wisdom is still sound.

"The U.S. Air Force highlights the concept of False Authority Syndrome
in Tongue & Quill, their official publication on effective writing:

Nonexpert opinion or assumed authority - Don't be swayed (or try to
sway someone else) based on the opinion of an unqualified authority.
The Air Force is chock-full of people who, because of their position
or authority in one field, are quoted on subjects in other fields
for which they have limited or no experience.

(As this Air Force publication notes, False Authority Syndrome can
attack people in all fields of expertise.)".

> My niggling concern has always been that
> malware (call it what you will) might remain 'somewhere' within a box
> ready to continue with it's malicious activity even though it's been
> flattened and windows reinstalled (or even if a *new* hard disk has been
> installed!).
>
> I suspect such thoughts came about from my contact and discussion with
> our then High Tech Crime Unit - who recommended that I *destroy/trash*
> the machine involved in my identity theft encounter.

See the quote above. Police units dealing with computer crime are not
authorities on malware. Their expertise is in gathering evidence
(computer forensics) for possible prosecutions. They need to know
where and what to look for on the system and, before they start, how
to preserve or not corrupt that information. Sure, they may employ or
consult experts who know something about particular malware in certain
cases but did you communicate with one of these experts? More likely
it was some desk sergeant or other front man whose job is not to
educate the public about the finer points of fraudulent or malicious
software but simply to give the safest and most general advice; i.e.
trash the machine. In fact, that sounds like pretty dumb advice from
anyone claiming to be an expert on malware.

> The implication was
> that there is much more going on 'behind the scenes'- things that the
> authorities do not want the public to know about!

There's no such implication - just your paranoid fantasies and
conspiracy theories at work.

[David H. Lipman]

From: "Ant" <not@home.today>

| "~BD~" wrote:
>> 1. The "False Authority Syndrome"

>> Don't believe everything. Some people talk or write about viruses as if
>> they were an authority in this field, but in fact they are often not.

>> Ref: http://www.claymania.com/info-fas.html

| The link to vmyths (for more about FAS) on that page is out of date.
| Use this: http://vmyths.com/fas/ which redirects to a PDF written by
| Rob Rosenberger. It's a bit dated now, talking about old msdos viruses
| and bulletin boards, but the wisdom is still sound.

< snip >

You don't see Robin on Usenet as much lately. For a short while he was posting malware
humour.

I was communicating with him offline not too long ago and I was pleasingly surprised that
Robin and I have something in common.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp

[~BD~]

Ant wrote:
> "~BD~" wrote:
>> 1. The "False Authority Syndrome"
>>
>> Don't believe everything. Some people talk or write about viruses as if
>> they were an authority in this field, but in fact they are often not.
>>
>> Ref: http://www.claymania.com/info-fas.html
>
> The link to vmyths (for more about FAS) on that page is out of date.
> Use this: http://vmyths.com/fas/ which redirects to a PDF written by
> Rob Rosenberger. It's a bit dated now, talking about old msdos viruses
> and bulletin boards, but the wisdom is still sound.
>
> "The U.S. Air Force highlights the concept of False Authority Syndrome
> in Tongue& Quill, their official publication on effective writing:
>
> Nonexpert opinion or assumed authority - Don't be swayed (or try to
> sway someone else) based on the opinion of an unqualified authority.
> The Air Force is chock-full of people who, because of their position
> or authority in one field, are quoted on subjects in other fields
> for which they have limited or no experience.
>
> (As this Air Force publication notes, False Authority Syndrome can
> attack people in all fields of expertise.)".

Thank you for the revision, Ant. The Conclusion in that document says,
quote:-

"I DON’T WANT to dispel any particular computer virus myths someone may
have told you — that’s not my goal here. Rather, I want you to question
a person’s expertise if he or she claims to speak with authority on
computer viruses."

>> My niggling concern has always been that
>> malware (call it what you will) might remain 'somewhere' within a box
>> ready to continue with it's malicious activity even though it's been
>> flattened and windows reinstalled (or even if a *new* hard disk has been
>> installed!).
>>
>> I suspect such thoughts came about from my contact and discussion with
>> our then High Tech Crime Unit - who recommended that I *destroy/trash*
>> the machine involved in my identity theft encounter.
>
> See the quote above. Police units dealing with computer crime are not
> authorities on malware. Their expertise is in gathering evidence
> (computer forensics) for possible prosecutions. They need to know
> where and what to look for on the system and, before they start, how
> to preserve or not corrupt that information. Sure, they may employ or
> consult experts who know something about particular malware in certain
> cases but did you communicate with one of these experts? More likely
> it was some desk sergeant or other front man whose job is not to
> educate the public about the finer points of fraudulent or malicious
> software but simply to give the safest and most general advice; i.e.
> trash the machine. In fact, that sounds like pretty dumb advice from
> anyone claiming to be an expert on malware.

You may well be right!

>> The implication was
>> that there is much more going on 'behind the scenes'- things that the
>> authorities do not want the public to know about!
>
> There's no such implication - just your paranoid fantasies and
> conspiracy theories at work.


Maybe so. Tell me, then, about the expertise and 'qualifications' of Mr
Lipman. I suspect that he's a 'professional' but seems reluctant to say
so. You talk as if you *know* him!

--
Dave

[Ant]

"~BD~" wrote:
> Tell me, then, about the expertise and 'qualifications' of Mr
> Lipman. I suspect that he's a 'professional' but seems reluctant to say
> so. You talk as if you *know* him!

How do you get the impression I know him from my previous post when I
never mentioned or referred to him?

As it happens, both he and I are long-time contributors to acv and
acav, he offers advice to help people clean their machines and
provides a useful tool to do that in the form of Multi-AV. So yes,
I know him on usenet and from a private forum of researchers and
anti-malware people and have corresponded with him in email. I don't
know what he does for a living or what qualifications he has and
neither do I care because the advice he gives is sound. All
indications are that he has a wide knowledge of computer security,
viruses and other malware.

As for my expertise, I've previously mentioned I'm a long-time
programmer with a particular interest in reverse engineering
malicious code. I know about the capabilities of most currently
circulating malware and popular exploits as you may have noticed from
other posts I've made to these groups. Of course, in this field it's
a constant learning experience as computer systems and software evolve
and the bay guys try out new methods.

I tend not to dispense advice about security or AV software because
that's not my area of interest or expertise and I don't use such
applications. If I have to clean infected systems I use my low-level
system knowledge and basic or specialist tools.

[Dustin Cook]

"Ant" <not@home.today> wrote in
news:HvKdnUrh5o0HVEHWnZ2dnUVZ8tEAAAAA@brightview.c o.uk:

> "~BD~" wrote:
>> Tell me, then, about the expertise and 'qualifications' of Mr
>> Lipman. I suspect that he's a 'professional' but seems reluctant to
say
>> so. You talk as if you *know* him!
>
> How do you get the impression I know him from my previous post when I
> never mentioned or referred to him?
>
> As it happens, both he and I are long-time contributors to acv and
> acav, he offers advice to help people clean their machines and
> provides a useful tool to do that in the form of Multi-AV. So yes,
> I know him on usenet and from a private forum of researchers and
> anti-malware people and have corresponded with him in email. I don't
> know what he does for a living or what qualifications he has and
> neither do I care because the advice he gives is sound. All
> indications are that he has a wide knowledge of computer security,
> viruses and other malware.
>
> As for my expertise, I've previously mentioned I'm a long-time
> programmer with a particular interest in reverse engineering
> malicious code. I know about the capabilities of most currently
> circulating malware and popular exploits as you may have noticed from
> other posts I've made to these groups. Of course, in this field it's
> a constant learning experience as computer systems and software evolve
> and the bay guys try out new methods.
>
> I tend not to dispense advice about security or AV software because
> that's not my area of interest or expertise and I don't use such
> applications. If I have to clean infected systems I use my low-level
> system knowledge and basic or specialist tools.

+1


--
"Hrrngh! Someday I'm going to hurl this...er...roll this...hrrngh.. nudge
this boulder right down a cliff." - Goblin Warrior

[~BD~]

Ant wrote:
> "~BD~" wrote:
>> Tell me, then, about the expertise and 'qualifications' of Mr
>> Lipman. I suspect that he's a 'professional' but seems reluctant to say
>> so. You talk as if you *know* him!
>
> How do you get the impression I know him from my previous post when I
> never mentioned or referred to him?

I had a son who was a computer guru - he's an angel now. He guides me!

> As it happens, both he and I are long-time contributors to acv and
> acav, he offers advice to help people clean their machines and
> provides a useful tool to do that in the form of Multi-AV. So yes,
> I know him on usenet and from a private forum of researchers and
> anti-malware people and have corresponded with him in email. I don't
> know what he does for a living or what qualifications he has and
> neither do I care because the advice he gives is sound. All
> indications are that he has a wide knowledge of computer security,
> viruses and other malware.

Thank you. What you say holds no surprises!

> As for my expertise, I've previously mentioned I'm a long-time
> programmer with a particular interest in reverse engineering
> malicious code. I know about the capabilities of most currently
> circulating malware and popular exploits as you may have noticed from
> other posts I've made to these groups. Of course, in this field it's
> a constant learning experience as computer systems and software evolve
> and the bay guys try out new methods.
>
> I tend not to dispense advice about security or AV software because
> that's not my area of interest or expertise and I don't use such
> applications. If I have to clean infected systems I use my low-level
> system knowledge and basic or specialist tools.

You sound much like the cyber-friend I made on the Kaspersky forums!

P2U is/was Dutch, Married to a Russian woman and lives(d) in Moscow. I
'met' him on the Kaspersky forums after I had bought KAV7 a few years
ago. Amongst other things he specialised in computer forensics and was
trying to help me investigate how 'bad guys' do things.


Here is a past PM conversation:

QUOTE (by me! BD)

If I type http://www.annex.com into IE7, my AOL browser or Firefox - it
works as expected (or should I say as I might expect?).
I wouldn't be surprised if you told me something was not quite right,
even at first base!

REPLY

I understand that googlesyndication and google-analytics are there
asking to execute scripts and to drop cookies, but what the **** are
live.com and msn.com doing there?!?
OK. I'll register later today as p2u. I have to go and see a student
right now. I'll be back in an hour or three.

Paul

__________________________________________________ ___________________

Regrettably, little further progress ensued. Here's the reason why.

Message from Paul, 27.09.2008 05:50

Hi, Dave!

Yes, I owe you an explanation, but I couldn't find the strength to write
you about it. At the end of last year, I was diagnosed with a swelling
in the pancreatic area. I've been through hell all this time. Life
expectancy is not much; at most 2 years. The problem is that the
swelling was benign, but is turning into a malignant one. An operation
means almost certain death. I'm not afraid of dying, not for myself - I
just wonder how my little son is going to take this.
I hope you understand, that in such a state of mind I'm not eager at all
to communicate with anyone. This is nothing personal. I hope you
understand that. That's also the reason why I rarely appear on this
forum - the 'how-are-you' stuff scares me. I don't know how I am and why
this is happening to me...

Kind regards,

Paul
__________________________________________________ _____________________


There is more information here should you be mildly interested.

http://www.microsoft.com/communities...&cr=&sloc=&p=1

Or http://snurl.com/vy6sc

It is basically an extract of posts I 'stored' on Jenn's BB but folk
would have to register to read same there. http://pqlr.org/bbs/

If I'm wasting your time, forgive me. My only ambition is to help, in
any small way, to ruffle the feathers of the bad guys to which you
refer. I seek only the truth.

--
Dave

[John Mason Jr]

On 5/1/2010 7:19 AM, ~BD~ wrote:
> Dustin Cook wrote:
>>
>> If the article claims an infection in the bios or eeprom vs corruption;
>> then the article is indeed, wrong. BD.
>
> Thank you, Dustin.
>
>>> Take a step outside the box, David.
>>
>> Google bios and eeproms David. You might find it somewhat enlightening.
>
> I've done much research!
>


So ask specific questions based on your research, if you post links to
where the information was obtained folks can look at the original material.

Many folks have told you that in their opinion, and experience this
behavior has not been observed in the wild.

If you don't want the opinion of folks in the newgroup why would you
continue to ask for it?

John

[FromTheRafters]

"~BD~" <BoaterDave@hot.mail.co.uk> wrote in message
news:JOSdndli_pDIk0HWnZ2dnUVZ8vqdnZ2d@bt.com...

[...]

> At that link it says - quote:-
>
> "When you run the fdisk command to create, delete, or change a
> partition, all of the data on that partition is permanently deleted".
>
> I've always understood that to mean that any malware would be
> destroyed too!

Bad sectors (or sectors *marked* as bad) in this case might be
considered "outside" any partition.

[...]

> That is my understanding too. My niggling concern has always been that
> malware (call it what you will) might remain 'somewhere' within a box
> ready to continue with it's malicious activity even though it's been
> flattened and windows reinstalled (or even if a *new* hard disk has
> been installed!).

Warning - - an analogy follows:

Some vaguely described monster has finally been *killed* by the monster
hunter and you have an uneasy feeling that the monster can rise from the
blood at the scene of the killing. Well, it ain't gonna happen, but when
you asked an expert if an entity like that could be resurrected from its
blood - he said yes and told you about DNA and sheep, cats, etc...

The thing is, the expert wasn't asked if the entity could self-resurrect
from the blood left behind after the killing of the monster.