[Full-Disclosure] Imaging Operating Systems

[Lachniet, Mark]

Any reason not to just use Ghost?

Also, some people use VMWARE, and make a "clean" VMWARE image, copy it,
load the suspicious stuff, and then delete it afterwards.  If you have
your virtual network interfaces disabled, it may be a fairly safe
sandbox to work in.

Mark Lachniet 

> -----Original Message-----
> From: Michael Schaefer [mailto:mbs at mistrealm.com] 
> Sent: Wednesday, May 26, 2004 2:55 PM
> To: Full-Disclosure
> Subject: [Full-Disclosure] Imaging Operating Systems
> 
> Hi all
> 
> We are building a Windows test system, to try out tool bars, 
> spy ware, malware and trojans on.
> 
> Once we learn what we need to know, we obviously want to get 
> rid of the junk quickly and cleanly.
> 
> I keep hearing suggestions about having a "clean image" to 
> transfer onto the computer.
> 
> Can anyone send some details?
> 
> Is there an official Microsoft way to do this?
> 
> Is some sort of over the network OS installation script in order here?
> 
> Are there other vendors that do a better job?
> 
> Thanks
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>