Solved Macrium Reflect- leaving junk?

[pincushion]

In reply to Senteaf

In reply to your question as to restoring images solving most malware issues - there can be malware in areas that are not restored during a system image restore, for example the MBR (Master Boot Record) but this can be overcome by various methods to restore or fix the MBR.

It is true that a restore is not guaranteed to work but in several dozen restores I have carried out with a variety of different software not a single one has failed even though it might not have solved my particular problem.

The essence of having a 'rolling' system image strategy and not needing to do a reinstall of the OS is to keep the system clean and I can understand your reluctance to trust your anti-virus but it has not failed me - as I said I do have sufficient experience over the years to trust it. I do know where to look for malware and have sufficient controls to see what is exactly happening on my system. Also I do use other software to check for malware apart from the anti-virus - things like HiJackThis and SpywareBlaster but these mainly have just found and allowed me to eliminate any unwanted start-ups like updating checks or browser add-ons.

Hope you find a solution that suits you.

 

[Senteaf]

The viruses that could reside in MBR section are probably the only way to infect a computer after a restoration of a clean image. It can only happen if you re-image single partition, but if I re-image the complete HD I should not have any problem as it restores everything.
So if I want to create a backup, I had better just re-image the whole HD. Other files like pictures can be saved as individual files not inside an image.

The problem with Anti-viruses, or other analyzing programs/controls as you mentioned, is that you can never be completely sure your computer is clean. But with HD image you can.
Why would you try to look for a virus when you can just re-image? (I assume you backup regularly)

By the way, would you please share a few of the programs you use to see what exactly happens on your system?
It can be helpful for many things, not just for malicious code.



Thank you!

 

[pincushion]

The viruses that could reside in MBR section are probably the only way to infect a computer after a restoration of a clean image. It can only happen if you re-image single partition, but if I re-image the complete HD I should not have any problem as it restores everything.
So if I want to create a backup, I had better just re-image the whole HD. Other files like pictures can be saved as individual files not inside an image.

The problem with Anti-viruses, or other analyzing programs/controls as you mentioned, is that you can never be completely sure your computer is clean. But with HD image you can.
Why would you try to look for a virus when you can just re-image? (I assume you backup regularly)

By the way, would you please share a few of the programs you use to see what exactly happens on your system?
It can be helpful for many things, not just for malicious code.



Thank you!

You can image the whole HDD but imaging just the system partition - especially if it is less than 100 GB - will mean that it takes less time, 10 minutes or less and will be correspondingly smaller in size. It is then possible to save quite a number of images so that should a problem occur you do have choices as to what to restore. On my system I have images going back about two months, averaging about one per week.

As my system has never had any malware (it shows no such symptoms) it has been clean from the start so subsequent images are also clean. My data is backed-up separately and almost immediately but could be automatic if I chose to do it. I don't bother looking for virii since every scan I have ever done has revealed nothing. A bit pointless and a waste of time if the system shows no symptoms.

If my system was liable to malware then I would invest in more powerful solutions but since it never has I haven't bothered to install any. You won't find me attempting to give advice about virus-removal since I have no experience of this.

Some of the applications I have to check for malware are Spybot S & D and HiJackThis together with Spywareblaster which helps to keep any dangerous webpages from infecting the system. I've installed various other programs but removed them since they never got used and I got fed-up updating them. I'm using Norton NIS and have used it for several years. I use CCleaner regularly and occasionally things like Process Explorer but these days I don't bother about malware because mainly it is not an issue. Occasionally I will have a dip into the registry just to check on things. A paid-for program I can recommend is Directory Snoop. This enables you to see inside every file on your system and has the added bonus of being able to retrieve deleted files.

Perhaps it is the way I use my system and I am less prone to malware since I am not a p2p user or gamer but I have a 'good' and a 'bad' browser. The good browser is IE9, which might not be the best but I actually like the general layout and how it functions. I use this for most normal browsing and most of the webpages I visit are unlikely to host malware - news, shopping etc. The bad browser is Firefox 8.0 and I use this with Private Mode set and no disk-caching with Noscript add-on. This I use for when I might have to delve into areas possibly a teeny weeny bit dangerous. I don't have Java installed and use Foxit for reading pdf files. I have various gadgets to see what is happening with regard to processor usage and downloads/uploads always onscreen. This policy seems to work fine so far.

I install all Windows Updates as they appear and Norton is allowed to update at least every day but most other apps I have to check and do manually.

A bit long but hope this helps. :shock:

 

[Senteaf]

You can image the whole HDD but imaging just the system partition - especially if it is less than 100 GB - will mean that it takes less time, 10 minutes or less and will be correspondingly smaller in size. It is then possible to save quite a number of images so that should a problem occur you do have choices as to what to restore. On my system I have images going back about two months, averaging about one per week.

As my system has never had any malware (it shows no such symptoms) it has been clean from the start so subsequent images are also clean. My data is backed-up separately and almost immediately but could be automatic if I chose to do it. I don't bother looking for virii since every scan I have ever done has revealed nothing. A bit pointless and a waste of time if the system shows no symptoms.

If my system was liable to malware then I would invest in more powerful solutions but since it never has I haven't bothered to install any. You won't find me attempting to give advice about virus-removal since I have no experience of this.

I don't have the experience you have so my only option to deal with viruses and malicious code is anti-virus.
The reason I became interested in imaging the whole hard disk was because I got infected by a virus which my anti-virus did not identify. I did not know what to do except to restore my hard disk to factory backup.
But of course if you only surf and not download files or install many programs then yes you don't have to bother scanning your computer every week and worry about viruses.
Now I want to make changes and modify my system so an image is the best solution. And if I already have an image I can also use it in case I get a virus.

Some of the applications I have to check for malware are Spybot S & D and HiJackThis together with Spywareblaster which helps to keep any dangerous webpages from infecting the system. I've installed various other programs but removed them since they never got used and I got fed-up updating them. I'm using Norton NIS and have used it for several years. I use CCleaner regularly and occasionally things like Process Explorer but these days I don't bother about malware because mainly it is not an issue. Occasionally I will have a dip into the registry just to check on things. A paid-for program I can recommend is Directory Snoop. This enables you to see inside every file on your system and has the added bonus of being able to retrieve deleted files.

Perhaps it is the way I use my system and I am less prone to malware since I am not a p2p user or gamer but I have a 'good' and a 'bad' browser. The good browser is IE9, which might not be the best but I actually like the general layout and how it functions. I use this for most normal browsing and most of the webpages I visit are unlikely to host malware - news, shopping etc. The bad browser is Firefox 8.0 and I use this with Private Mode set and no disk-caching with Noscript add-on. This I use for when I might have to delve into areas possibly a teeny weeny bit dangerous. I don't have Java installed and use Foxit for reading pdf files. I have various gadgets to see what is happening with regard to processor usage and downloads/uploads always onscreen. This policy seems to work fine so far.

I install all Windows Updates as they appear and Norton is allowed to update at least every day but most other apps I have to check and do manually.

A bit long but hope this helps. :shock:

Thanks for the programs. I will look into the process tools you mentioned and I think there is also a free program which is similiar to Directory Snoop.
For the other tools, you actually don't need them as the anti-virus includes the same features like realtime browsing protection which you said is vital for your protection.
And by the way I do the complete opposite; Firefox is my "good" browser and IE is my "bad" browser.

 

[pincushion]

I think it all comes down to what works for yourself and your system - as you say I am most likely less liable to malware in the first place. If I was to do a lot of p2p downloading or gaming I would seriously consider a second computer or have a another OS set up specifically for this. I know Norton is not regarded by many to be the best solution and there are many good free and paid-for solutions but it works for me and has done for years but it does need a fair bit of customising to lessen its intrusiveness. Perhaps some might say that imaging is not totally reliable or the perfect solution but it has been reliable for me. I suggest you do some testing with the various options - Macrium Reflect free has been reliable for me at least (using the Linux boot disk) and SyncBack the same for backing-up data.

I think this forum provides most of the answers to questions - especially the tutorials. Good luck with whatever you decide.



ps You are probably right about my not needing some of the software - bit of a legacy from the past.

pps If you use Macrium Reflect and have the 100 Mb or so partition then you can image that together with your system partition or do them separately. Then both can be restored or for perhaps just software or other problems the system can just be restored. I have found that I haven't needed to restore the smaller partition but then I wasn't dealing with malware.

 

[Senteaf]

Yes you are right, it all depends on what you do with your system.
Yes I can understand the legacy you are talking about - I have many troubleshooting disks my father used to have and show me while he was fixing the system.

And yes that's a good idea, I can image the 100MB partition if I don't want the whole disk but want to be sure there are no viruses on boot.

Thanks!