I have a major amount of time invested in the installation of programs, OS
updates etc on my system. I'd hate to go through the process again!
Been there; bite the bullet! The only way to avoid this is to have periodic
images (backups) so that if you discover that you're infected today, you can
back up to a week ago or so. Even then, you may have been infected a month
earlier - the AV and AT's signatures generally "lag" behind the actualy
introduction into the wild.
At this point, IIWY, I'd create a little document somewhere listing the
rebuilding steps - in sequence. Export your account IAF's if you use
O.E., have all of your ISP account and password info. on that document
next to the point that you need it; for example, create your network connection.
Get all of your registry tweaks together. In some cases, export the actual
registry data and have all of your .regs together. ETc.
If you ever wanted to run two or three partitions (e.g. small system partition,
a second, ecrypted partition to put your mail, personal stuff in) then now
is the time to do it. The advantage here is that if you blow your opsys,
you still havn't lost your personal stuff.
If I
install a software firewall like ZoneAlert to tell me if something is
accessing the internet without my permission, will that suffice?
Yes, in theory - if it was a single, simple, isolated program somewhere. But
if it has infested your kernel and/or browser, then it could both betray you
(keylogger) as well as slow down your system.
Go here:
http://www.firewallleaktester.com/tests.htm
As you can tell, the new ZA pro is a pretty good FW, but it alone can't
block many exploits. IF you supplement ZA or LnS with a behaviour monitor
(e.g. SSM ) BEFORE you're infected, then you'd probably not have been
infected in the first place - but could block it as you propose. Probably
too late now.
SSM:
http://maxcomputing.narod.ru/ssme.html?lang=en
(FWIW, I've blocked all of these exploits with a combination of Outpost
Free, Sygate PF, and SSM. But I'd guess that the new ZA (or new Look N Stop)
in combination with SSM could also do it).
From my understanding, viruses make themselves hard to delete. But a trojan
delivers an incidious payload. And I would think that after it did so, it
would delete itself to cover up its tracks. What are the chances the trojans
left something behind if they were still around to be found?
These distinctions between Trojan and Virus behaviour are invalid (IMHO).
Anything goes.
Good Luck.
