Which Shadow Program and Why?

There will be always a malware or tool that destroys a system partition with or without ISR-software.

Two possibilities :
A. Security softwares will stop them,
- if it is an executable, it doesn't have a chance. AE removes such a malware immediately.
- if it is sandboxed, it doesn't have a chance and my sandbox is empty after closing Firefox.
- if it is a spam-email, it is already deleted, before opening.
- if that doesn't help, plan B.
B. Zero Tool and Image Backup software will fix it. Problem solved.

I don't understand what the big advantage is of having an ISR-software that passed the test of only 3 destructive malwares.
One day there will be a malware that destroys these ISR-softwares also and what then ? Use another ISR-software and drop all other arrangements ? All that just for one malware ? That is absurd.

I know in advance that this can happen and I have a solution. Case closed.
You only have to be worried, if you don't have a backup plan.

 

as I know, the CleanMBR uses the directly I/O to access harddisk.

Win32
---------------
|
V
Kernel driver
-----------
|
V
file system (AV often work here)
------------
|
V
disk system (SD works here)
------------
|
V
harddisk (CleanMBR uses the directly I/O to send comand to the ATA port)

 

If possible can you pass along the url to this tool. These discussions and comparisons have seem to taken on a whole new form of life and interest of it's own as everyone scrambles to reach for that one prize app that takes the lead in these type most safe coverages, and FWIW it's generating some very useful excitement not often seen of this magintude.

Thanks

 

there is a video in Youtobe.com. It is not in high quality. I hope it is helpful.

http://www.youtube.com/watch?v=wD6TJ0aM89Q

The test is in VMware.

XP Pro SP2, CleanMbr 1.0, SD 1.0.130.

 

Can you either send me the tool or just test Returnil too? I'm interested in knowing more. Thank you.

 

thats why using any virtual programs is good + AE so no matter if u are using even shadowuser pro which is 3 years old (in feb 2008 )

cheers

 

Yes, I just tested the Returnil PE 1.70.7502 in the same environment. RVS PE is immune to the CleanMBR. i will try to upload the video to Youtobe.com tomorrow.

 

Wonder if there more imaging,virt. app. coming who respect the MBR like latest version of FDISR

 

But when all applications start using the PBR like FDISR, doesn't that create another problem ?