I used my 2.41 based CD with SP2 on a clients computer who had a major virus/spyware hijack of his lsass.exe . He was getting lsass.exe errors in both regular and safe mode. So I booted from my CD as I often do to take a look at his system, and behold the lsass.exe on my CD also crashed and UBCD4Win went crazy (no programs would load cd). I have never seen a clients problems on their hard drive affect my CD. Why would it? The CD shouldnt be reading anything from their hard drive, but apparently it does.

So I loaded up an older CD from several months ago that still was built with SP1, and it wasnt affected at all.

That said, anyone have any idea how I can tweak my CD so that it NEVER loads/checks anything from the clients HD? I dont want their viruses/spyware affecting my stuff

I can't imagine why you would be having the problems you seem to be having. Rewritable media (CD-R, CD-RW) may have some vulnerabilities that I am unaware of, but I really don't think your CD is being infected. If you suspect this, then you must insist on scanning the CD with your resident A/V and several online scanners before and after use.

Use these links as a general guide for cleaning:
http://www.ubcd4win.com/forum/index.php?showtopic=114
http://www.wilderssecurity.com/showthread.php?t=50662
http://forum.grisoft.cz/freeforum/read.php?4,27725,backpage=

And don't forget prevention:
http://www.us-cert.gov/
http://www.microsoft.com/athome/security/v...s/virus101.mspx
http://www.unwantedlinks.com/removespyware.htm
http://support-antivirus.web.cern.ch/suppo...tivirus/how-to/
http://www.bitdefender.com/bd/site/virusinfo.php?menu_id=4
etc, etc, etc...



It sounds like you may be scanning from a CD launched from the desktop and still connected to the net. Booting from the CD (with network) eliminates a lot of grief and is arguably more effective than Safe Mode.

You misunderstand, the CD isnt being Infected, its being Affected by the problems on the hard drive. The CD is finding the changes to lsass.exe on the hard drive and importing those changes to the new enviroment.

So if lsass.exe is hacked on the system and has some module attached to it, it was seeing that change and loading that module again when I booted from the CD. So the clients problems on the drive were affecting the BartPE environment.

How, why, I have no clue. That was the first time ive ever seen such a problem.

PREVENTION should be emphasized over cleanup. It is a bear to cleanup any infected machine. You are ultimately left with a shell that is a mere shadow of itself despite your best cleanup efforts. Despite access to the best tools available, the OS has been compromised. There is no way you can guarantee that a thoroughly cleaned PC is now ready for service. There are a multitude of default security settings provided by a clean install that are blitzed and nullified by most infections.

The following is not in any order of importance. All are significant and interrelated.

A hardware based firewall is your first line of defense.
http://www.smoothwall.org/

The second line of defense : all the security recommendations here-
http://leoville.tv/radio/pmwiki.php/Main/M...ecuritySoftware

The third line of defense is user education.

The fourth line of defense is knowledgeable installers providing end users with a secure PC noting the above and not leaving admin accounts open to anyone (including hackers.) Daily backups of vital documents are absolutely essential.

On any given day, it's easier to install a fresh OS than to try to clean a PC using this project or any other. Despite your best efforts, you will be left with a less than secure PC any day of the week. Format the HD and reinstall!!

Focus on prevention!

This CD has it's uses and is extremely competent at what it provides, but prevention cannot be stressed enough.

Do you know what the PC was infected with??

Once the PC was cleaned did you still have the same problem's with SP2??

Sounds like a possible Blaster virus infection? I'm not sure how you can prevent the UBCD4WIN enviroment from interacting with the actual OS installed on the machine. (Is Lsass.exe a part of Win9x? Because the CD with work with those OS's.)


Anyway, as an alternative, running a virus removal using the original Ultimate Boot CD might have been an option for you. Instead of working through Windows it would have been through DOS. Sometimes if a machine is badly infected I will do this first.

Good luck.

That is really strange, this behavior has never been reported before. I don't know all the technical aspects for Bart's PE, but this shouldn't be happening. I'll contact a few people and see if I can find any answers.