How To never Worry About Malware Again!

donetao

Level 20
Thread author
Verified
Sep 7, 2014
968
Hi Very nice and looks good. What happens when your HD bites the dust? With Macrium, I just install a new HD and restore the image to the new drive with the rescue Windows PE3.1 . I guess it would be worth the money if I was doing all the testing you are doing.
Thanks it was very interesting. I will pass for now.;)
 
  • Like
Reactions: Oxygen and Welldone

donetao

Level 20
Thread author
Verified
Sep 7, 2014
968
Hi @Behold Eck Here's a good read about incremental and deferential back ups. You can Google and find lots of advise on the Web.
I like old Leo.;) He gives a lot of good advise.
https://askleo.com/is-it-better-to-use-incremental-or-differential-backups/

Here's the bottom line my friends on MT. You will never have a better defense against malware than a back up image that is free from malware. The next best thing is back to factory and that's not a bad idea some times; but it takes a lot more work , some thing I have done before.
However; I've been there and done that before, so I'm not interested in that at this moment. Not saying I won't give that some thought in the future.
A nice clean install is good. A restore of your OS to a time when all was good on your PC is also good.
I'm hoping that all our guests that are reading hot topics and looking for freebies read this hot topic and commit to creating a back up image of their OS. You don't have to choose Macrium. There are a lot of good free programs that Will-Get-er_Done.
Good night!
PS If you are a guest to night and you liked this; register and become a member here on MT.
 
Last edited by a moderator:
  • Like
Reactions: frogboy and Jaspion

Welldone

Level 5
Verified
Dec 29, 2012
235
It is not freeware, but an excellent program. Horizon DataSys..

Here is a review written by our very own Umbra..
http://malwaretips.com/threads/review-rollback-rx-pro-v10.9265/
This software works like a dream if one knows the limitations of using this software,otherwise it would turn into a nightmare.:p
Hard Disk Support – Rollback Rx can only protect one IDE/SATA/PATA hard drive. If a system has more than one hard disk, Rollback Rx will protect the drive designated as the “Primary” harddisk (also called Disk 0). Rollback Rx Client does not support SCSI, RAID or MIRROR hard drive configurations.


Booting From an External Media (OS) – Rollback Rx cannot protect the hard drive when changes are made to the hard drive from an external or foreign (non-Windows) operating system bypassing Rollback Rx protection drivers. For example, booting from a CD-ROM will start a different OS that may be able to change the hard drive and
produce unpredictable results.

Disk Encryption Programs that Intercept Low-Level Disk I/O – Rollback Rx may conflict with some applications that proxy low-level disk I/O.

Compressed Drives
– Rollback Rx cannot be installed on compressed NTFS drives. (The workaround is to uncompress the drive, install Rollback Rx, and then re-compress the drive)

Disk Repartitioning – The disk with Rollback Rx installed cannot be re-partitioned without uninstalling Rollback Rx.

Dual Boot of Windows and Linux OS on the Same Hard Drive – Rollback Rx does not support systems that have multiple Windows Operating Systems with non-Windows Operating Systems (like Linux or Apple Mac OS) loaded on the same hard drive.

Use of Defragmenter Programs – Once installed, Rollback Rx blocks the use of defragmentation programs. The reason for this is that Rollback Rx tracks sector change activity, relocates some sectors, and maintains its own map of all the disc's sector locations on the hard drive. Defragmentation is the process of locating the noncontiguous sectors of a file and rearranging the sectors more efficiently by relocating them into fewer sectors.

As a result, once Rollback Rx is installed, the work done by a defragmentation program would not provide the desired result. Thus, defragmentation programs are blocked. The need for a defragmenter varies according to file system and the amount of file creation and update activity on a hard drive. Horizon Datasys recommends that defragmentation be done before installing Rollback Rx. In addtion, Rollback Rx has a build-in defragmenter as the prefered alternative and defragments at the sector level unlike the defragmenter that comes included with Windows which only works at the Windows file-and-folder level.

Operating System Upgrade – Before upgrading the operating system such as from Windows XP to Windows Vista, you must first uninstall Rollback Rx.

Useful thread on RollBack Rx: http://www.wilderssecurity.com/threads/hoizondata-rollback-rx.371810/

The bottom line is one should use a backup/imaging software like Macrium Reflect especially if they are using RollBack Rx since RollBack Rx' Snapshots doesn't help if/when the HDD fails;)
 
Last edited:
  • Like
Reactions: donetao and frogboy

frogboy

In memoriam 1961-2018
Verified
Top Poster
Well-known
Jun 9, 2013
6,720
This software works like a dream if one knows the limitations of using this software,otherwise it would turn into a nightmare.:p
Hard Disk Support – Rollback Rx can only protect one IDE/SATA/PATA hard drive. If a system has more than one hard disk, Rollback Rx will protect the drive designated as the “Primary” harddisk (also called Disk 0). Rollback Rx Client does not support SCSI, RAID or MIRROR hard drive configurations.


Booting From an External Media (OS) – Rollback Rx cannot protect the hard drive when changes are made to the hard drive from an external or foreign (non-Windows) operating system bypassing Rollback Rx protection drivers. For example, booting from a CD-ROM will start a different OS that may be able to change the hard drive and
produce unpredictable results.

Disk Encryption Programs that Intercept Low-Level Disk I/O – Rollback Rx may conflict with some applications that proxy low-level disk I/O.

Compressed Drives
– Rollback Rx cannot be installed on compressed NTFS drives. (The workaround is to uncompress the drive, install Rollback Rx, and then re-compress the drive)

Disk Repartitioning – The disk with Rollback Rx installed cannot be re-partitioned without uninstalling Rollback Rx.

Dual Boot of Windows and Linux OS on the Same Hard Drive – Rollback Rx does not support systems that have multiple Windows Operating Systems with non-Windows Operating Systems (like Linux or Apple Mac OS) loaded on the same hard drive.

Use of Defragmenter Programs – Once installed, Rollback Rx blocks the use of defragmentation programs. The reason for this is that Rollback Rx tracks sector change activity, relocates some sectors, and maintains its own map of all the disc's sector locations on the hard drive. Defragmentation is the process of locating the noncontiguous sectors of a file and rearranging the sectors more efficiently by relocating them into fewer sectors.

As a result, once Rollback Rx is installed, the work done by a defragmentation program would not provide the desired result. Thus, defragmentation programs are blocked. The need for a defragmenter varies according to file system and the amount of file creation and update activity on a hard drive. Horizon Datasys recommends that defragmentation be done before installing Rollback Rx. In addtion, Rollback Rx has a build-in defragmenter as the prefered alternative and defragments at the sector level unlike the defragmenter that comes included with Windows which only works at the Windows file-and-folder level.

Operating System Upgrade – Before upgrading the operating system such as from Windows XP to Windows Vista, you must first uninstall Rollback Rx.

Useful thread on RollBack Rx: http://www.wilderssecurity.com/threads/hoizondata-rollback-rx.371810/

The bottom line is one should use a backup/imaging software like Macrium Reflect especially if they are using RollBack Rx since RollBack Rx' Snapshots doesn't help if the HDD fails;)
That is to many restrictions for me i will stick to backups for free. ;)
 
I

illumination

I think a few of you misunderstood my intentions.. It was not to replace your back up procedures. If i was to use rollback rx, i would also have restore disk made, and or a image via the products all listed here as well as using rollback. Rollback creates a baseline, so that any changes made after that may be undone, if i am correct, this relates directly to the topic of this thread, as if one were to become infected, there would be no need to completely re-image the system and or factory reset when they could just revert those new changes in a matter of a couple minutes "without" losing everything else.
 

Welldone

Level 5
Verified
Dec 29, 2012
235
If one were to become infected, there would be no need to completely re-image the system and or factory reset when they could just revert those new changes in a matter of a couple minutes "without" losing everything else.
I have been using RollBack Rx for more than 4 years and it is not a good idea to rely on RollBack Rx for Security.

No,if rootkits/any advanced malware modify Master Boot Record,there is no way to use RollBack Rx' Snapshots unless one has backup of RollBack Rx' MBR.So RollBack Rx is not immune to malware(like rootkits) as well.;)

IMHO,RollBack Rx can be used only for testing software.It is only there for the convenience of fast restores.

http://www.wilderssecurity.com/threads/rollback-rx-and-its-mbr.329249/

http://www.wilderssecurity.com/threads/virtualization-rollback-software-test.276210/

http://community.horizondatasys.com/forum/rollback-rx/1415-windows-8-1-update-1-kb2919355
 
Last edited:
  • Like
Reactions: donetao and Moose
I

illumination

I have been using RollBack Rx for more than 4 years and it is not a good idea to rely on RollBack Rx for Security.

No,if rootkits/any advanced malware modify Master Boot Record,there is no way to use RollBack Rx' Snapshots unless one has backup of RollBack Rx' MBR.So RollBack Rx is not immune to malware(like rootkits) as well.;)

IMHO,RollBack Rx can be used only for testing software.It is only there for the convenience of fast restores.

http://www.wilderssecurity.com/threads/rollback-rx-and-its-mbr.329249/

http://www.wilderssecurity.com/threads/virtualization-rollback-software-test.276210/

http://community.horizondatasys.com/forum/rollback-rx/1415-windows-8-1-update-1-kb2919355
Is this the part where i have to literally spell it out for a few people.. As i did not say use this instead of a security solution.. I did not say use this instead of a back up solution, and obviously, this program must have some worth if you have been using it for 4 years.. ;)

As you stated, some forms of rootkit/bootkits, could cause issue, just as they could even for a recovery partition, that is why having several forms of back up and useful tools is not only smart, but needed these days.
 
  • Like
Reactions: donetao

Welldone

Level 5
Verified
Dec 29, 2012
235
Is this the part where i have to literally spell it out for a few people.. As i did not say use this instead of a security solution.. I did not say use this instead of a back up solution, and obviously, this program must have some worth if you have been using it for 4 years.. ;)

As you stated, some forms of rootkit/bootkits, could cause issue, just as they could even for a recovery partition, that is why having several forms of back up and useful tools is not only smart, but needed these days.
Yeah,i agree it is awesome software to use.I bought RollBack Rx for just 1000 INR then.:D

Hope one doesn't use RollBack Rx to test malware on their PCs :p
 
I

illumination

Yeah,i agree it is awesome software to use.I bought RollBack Rx for just 1000 INR then.:D

Hope one doesn't use RollBack Rx to test malware on their PCs :p
LOL, I hope they do not either.. When one thinks about real world scenario's though, it is a handy piece of software. I use something similiar to it on Linux called Timeshift, that also makes a baseline, and allows you to make incremental snapshots, so at anytime you can revert system changes.

I look at it like this, in the last 6 years of me cleaning infected machines around the area i live, i have seen zero "bootkits", and literally around a handful of rootkits.. This is a real life scenario.. I have how ever seen a lot of Trojans, more so back around 4-5 years ago, and now mainly see adware and PUP's with an occasional trojan/ransomware,ect.. Rollback will handle reverting changes of adware and PUP's and not only handle it, but save one many headaches of manually removing.. Now as stated above, one should not rely on this only for security, but an excellent addition..

Even with my Linux machine, which many claim you do not need any extra security, i run an AV, have a on-demand rootkit scanner, and use Timeshift for snapshots, and back up my personal files constantly, and keep a copy of the distro on flash drive "as formatting a drive, installing and updating this distro" only takes an hour ;) I do not consider this paranoid, or over kill, i call it being prepared, as with Linux, the chances are quite slim, but there are still chances..
 

Moose

Level 22
Jun 14, 2011
2,271
@illumination: Which on demand rootkit scanner do use? And do you use one on your Windows system?

Kind regards,
 
I

illumination

@illumination: Which on demand rootkit scanner do use? And do you use one on your Windows system?

Kind regards,
Chkrootkit is the one i use for my Linux distro's, and there is also rkhunter..
The only Windows installation i have at the time, is in a VM on my Linux machine, so i do not use one for it ;)
 
  • Like
Reactions: Moose

donetao

Level 20
Thread author
Verified
Sep 7, 2014
968
Thanks guys! You have really made my thread a complete master piece. Lots of good stuff and I have learned a lot.
I hope all our members and guest read every thing here. Great discussion. I can see where if you were testing, Roolback would be a must.
Great job everyone. Keep it going. Maybe we will make top billing on Google:):)
 
  • Like
Reactions: frogboy and Oxygen
I

illumination

Thanks guys! You have really made my thread a complete master piece. Lots of good stuff and I have learned a lot.
I hope all our members and guest read every thing here. Great discussion. I can see where if you were testing, Roolback would be a must.
Great job everyone. Keep it going. Maybe we will make top billing on Google:):)
What i have been trying to convey, is that programs like rollback are useful for more then just testing..

Lets say you are using a internet security suite, and a newer version comes out, you upgrade, and immediately you are faced with a bluescreen.. This is where the software shines, as a simple click of the incremental snapshot, and you are back to good to go..

Lets also say that you are surfing with your favorite browser, and downlaoding a program, that was without your knowledge, bundled with adware, now your browser is going crazy with pop ups and redirects, and no matter how you try to kill it off, it keeps coming back, then steps in another snapshot restored, and system good to go, without racking your brain trying to figure out where this adware is embedded on your system, and without having to preform a full system image.. If you back up your personal files as soon as they are created, and keep this habit, and make incremental snapshots with this software, you will not lose anything like a full reformat..

It is not a full solution to solving all problems, but an added addition that just makes life better..
 

Behold Eck

Level 15
Verified
Top Poster
Well-known
Jun 22, 2014
719
Hi @Behold Eck Here's a good read about incremental and deferential back ups. You can Google and find lots of advise on the Web.
I like old Leo.;) He gives a lot of good advise.
https://askleo.com/is-it-better-to-use-incremental-or-differential-backups/

Hi don, interesting stuff but I think I`ll stick to the basics.That was a good point about an incremental back-up maybe being corrupted or infected.

Maybe useful to keep a clean image back-up straight after a complete reinstall incase one of your later images is corrupt ?

Toolwiz Timefreeze is a reboot restore program that is light and free that may come in handy if your working with people that need constant reimaging/restores.

Plenty to think about with the various discussions going on here.

Regards Eck:)
 
  • Like
Reactions: frogboy and donetao

donetao

Level 20
Thread author
Verified
Sep 7, 2014
968
Maybe useful to keep a clean image back-up straight after a complete reinstall incase one of your later images is corrupt ?
Yes Good idea Eck. I have a Macrium back up image after a complete reinstall on my external HD. I pretty much know if a image is corrupted and I have 13 images at the moment. I'm sure one of them is clean.;) I like to verify each image. It's not good to try to install a image and find out it's corrupted. Good tip sir!!
 
  • Like
Reactions: Moose and Oxygen

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top