mdlbear | Microsoft says recovery from malware becomming impossible (Reply)

This eWeek article starts with the following:

In a rare discussion on the severity of the Windows malware scourge, a Microsoft security official said businesses should consider investing in an automated process to wipe hard drives and reinstall operating systems as a practical way to recover from malware infestation.

"When you are dealing with rootkits and some advanced spyware programs, the only solution is to rebuild from scratch. In some cases, there really is no way to recover without nuking the systems from orbit," Mike Danseglio, program manager in the Security Solutions group at Microsoft, said in a presentation at the InfoSec World conference here.

Now, the second part of this is true even in the Unix/Linux world: once your machine has been compromised, the only really reliable way to deal with it is to nuke it and re-install. The difference is that in the Unix world it doesn't happen very often, it doesn't take long to fix, and your local data (user home directories, databases, etc.) are going to be in separate partitions that don't have to be wiped because user code is very unlikely to be capable of compromising the system.

The first paragraph, though, says that Windows is so insecure and so badly broken that the only thing you can do is minimise your downtime when the inevitable, frequent, successful attacks occur. And that neither Microsoft nor its users see any other solution.