Slashdot Mirror

LinuxDefender runs Linux off of the CD, but uses Captive NTFS to mount the NTFS partitions on your hard drive and scan them.
(You'll need an XP license to be able to use XP SP1 to extract the NTFS drivers--if you use FAT32 that won't be an issue.)

I notice they pulled the download but it's still available from the mirror at http://ftp.iasi.roedu.net/mirrors/ftp.bitdefender. com/pub/Live/, see
http://buy.bitdefender.com/bd/site/mirrors.php/.

Went to the site, but I don't immediately see how this will scan Windows system from a Live CD that should be able to spot and remove rootkits that would evade detection when running under the operating system itself. They look more like they're into Linux solutions.

Here you go http://www.bitdefender.com/bd/site/presscenter.php ?menu_id=25&n_id=84/ I've used an earlier incarnation, works well.

Use BitDefender. Ranked highest in PC Magazine (although the commercial version is pricey), the free version is up for Windows and Linux.

I'm sure that this will be covered, but I have installed ClamWin on my Mom's and Mother-in-laws computers to cover their anti-virus needs. Every now and then I'll get a call or glance at it when I'm over, but the most complicated thing for them is when they get a 'new engine available, click to download' link; which the click, it's installed, and they're done. All virus updates happen daily and it'll report that to them so they know things are working via the icon in the taskbar. At home on my FreeBSD mailserver I trust GPLd clam AV and BitDefender in parallel, so I know it works, no reason for this 40$ a year McAfee with the all the bloatware you'd never need! ;)

I haven't seen any BitDefener recommendations yet. I will be considering it along with Kaspersky, F-Secure and NOD32.

BitDefender
http://www.bitdefender.com/

The New Virus Fighters: Our Antivirus Picks
http://www.pcworld.com/reviews/article/0,aid,12416 3,pg,3,00.asp

We have a penalty for blatant ignorance. This results in a two year internet privilege suspension and an additional beating around the ears with an Internet for Total Fucking Dummies book. PLease step away from the keyboard and assume the position!

Symantec Antivirus Center
Computer Associates Virus Information Center"
McAfee Virus Library
Kaspersky Virus Encyclopedia
Panda Software Virus Encyclopedia
Sophos virus analyses
BitDefender Virus Encyclopedia

For those that will argue that these search engines do not behave as the article requested; it is simply a matter of searching for the right symptoms. If you accurately describe the behavior of the virus, all of these search engines give you the answer.

The fact of the matter is that the very best solution is simply to use a commercial antivirus solution. If you are infected with a 0hour virus, simply wait an hour and run the update utility. Such a product will at least see the virus and tell you its name, even if it is unable to clean it. Worst case you have to use a bootable CD-ROM OS to catch/clean it.

Last month, a smaller antivirus producer was also detected by MS Antispyware as a Chinese nasty. Last year, the same producer reported a similar issue. Meanwhile, Microsoft protects itself by keeping this Beta1 title on this "product"; but the wide spreading of this (the software has been downloaded about 25 million times, according to Microsoft) could be very well a marketing tactics... I just wonder: are these the opening shots in Microsoft's attempt to muscle competitors out of the lucrative software security market?

HijackThis

Vundo removal tool

Some Free removal tools and the Bitdefender Live CD

I've used ClamAV (and Clamwin), AVG, Avast, AntiVir and Norton and McAfee.

None of them come even close to BitDefender when it comes to Windows. Its free (and there's a linux version) - but only for home use. I'm trying to get them to pay for it at work - McAfee sucks.

Anyway, give it a go. I seem to remember it got 100% a few weeks back on Slashdot, I tried it and I'd never go back to AVG*.

http://www.bitdefender.com/site/Main/view/Download -Free-Products.html

It's probably the best AV out there - well, apart from ClamAV - because its a beauty to work with on a mail server.

* Just like I didn't go back to ZoneAlarm when I found out about SyGate.

Btw, here is the BitDefender site information about the virus:

The trojan apparently installs an IRC backdoor on the affected system and may have other functions.

And the technical analysis is here

It is virtually impossible for a normal user to detect presence of any files hidden by Sony DRM Software. blah blah.

Btw, here is the BitDefender site information about the virus:

The trojan apparently installs an IRC backdoor on the affected system and may have other functions.

And the technical analysis is here

It is virtually impossible for a normal user to detect presence of any files hidden by Sony DRM Software. blah blah.

http://www.bitdefender.com/VIRUS-1000058-en--Backd oor.IRC.Snyd.A.html

Naturally, they are promoting their software as protection.

http://www.bitdefender.com/VIRUS-1000058-en--Backd oor.IRC.Snyd.A.html

Naturally, they are promoting their software as protection.

there's already a windows security software line called bit defender. that's the first thing i thought of when i saw the word 'defender' in the news w/ microsoft. i had thought ms bought them out or something.

http://www.bitdefender.com/

through extrapolation....one can assume that "most prolific" equates to "finds the most bugs"

Almost, but not quite. Quoting from the contest FAQ:

Q. The rules weren't quite clear. What are we supposed to do in order to win?

A. Send bug reports that have not been sent by someone else. They will be rated and a score from 1 to 3 will be announced by the judges in 24h max from the bug's arrival. At the end, the person with the most points wins.

There are other windows free AV products: BitDefender
is a very good one, and came really highly rated in a recent comparison (posted on slashdot I think)

Avast is another one, but that proved difficult to get rid of once installed. I can't remember why I wanted to uninstall it....

And BitDefender

http://www.bitdefender.com/site/Main/view/Download -Free-Products.html

Mod parent down. The fine article about the test specifically states that only one of the solutions that tested 6/6 provided a large number of false positives, and flagged the infected files as such simply by deciding that all packed executables are suspect. The other, is actually commended for having a low false positives rate.

A lot of other AV companies are releasing even open-source solutions for Linux. BitDefender offers a GPL vfs for Samba servers. Not to mention their support for allmost all Linux mail servers, i.e. Sendmail, Postfix, qmail, CommuniGate Pro, Courier.

I'm surprised I haven't seen a modded post about this mistake. In the list, the Photoshop CS website is listed as http://www.adobe.com/products/photoshop/main.html but it goes somewhere Completely different.

What concoction do you have to drink in order to mix those two up? There's not even anything from bitdefender on the list...

According to this story on the register, the MS anti spyware tool also labels Bitdefender (a romanian anti virus tool) as spyware.

If you think that's bad, check out BitDefender and eTrust Antivirus for Palm OS. There are some Palm OS models that can go online wirelessly, but the chance of a "virus" hitting them is very slim. Yay for corporate paranoia.

Seriously, how hard can it be for MS to write an application as straightforward, yet secure as Firefox.

Perhaps lots of people, including Microsoft itself, have an interest in perpetuating the myth that software is inherently insecure.

Even better, Microsoft makes it easy for you with Cabwiz.

Seth Fogie from Airscanner gave a talk on Window's Mobile PDAs at Defcon this year. Sending CAB files is one way to easily package a trojan in with a game. Plus after installing, the CAB file self destructs. He showed that with this method you could easily replace the onscreen keyboard with your own and log it, open a port and connect with some dev tools to get VNC type access or just place a program in the startup that resets the machine. The only way out then is a hard reset to factory default.

He also mentioned some buffer overflow vulnerabilities and showed that once you got your shellcode over, you could set the flag for the aforementioned hard reset to happen during the next reboot.

As for dust, a few small changes and it goes from mostly harmless to a pretty potent virus (for example, it will no longer ask you if it's allowed to spread hehe).

With the PDAs becoming more popular in business settings (particularly with Wifi access) these problems change from minor end user inconvenience to a source of sensitive information leakage.

BitDefender understands Mozilla Mail/Thunderbird's mail format, and properly deletes infected messages from your mail folders. It doesn't integrate with Thunderbird, though.

The first was mentioned in a blog, and uses F-Prot, which is FAIB for home/personal use.

There's also Knoppix STD, a security/vulnerability live CD that includes ClamAV. Doesn't look like they're using the Captive NTFS driver, though, so not sure how well that'll work compared to one that does, like...

BitDefender, which seems to be All That And More. It uses Captive, has ClamAV, and I'm pretty sure it's GPL'd, too. (The company does make commercial/proprietary products too.)

These take care of viruses. I'm not aware of any spyware-removal programs that run under Linux, which is a shame. It really would make it easier to boot from the CD, sip coffee for 15 minutes, then go back to Windows with that fresh feeling...

Can anyone recommend a good server-side tool to block viruses and worms?

Try Inflex which runs on top of sendmail or postfix, and the linux version of BitDefenderAV.

Both run on my mail gateway.

After viewing this thread I noticed that Clam AV came up quite a bit. So I went to their website and went to the news section. From there I saw a link for PC worlds response times articles. Here is the original article in german. Clam AV is #5, but the AV program I use frequently is BitDefender, which is ranked #2. I use BitDefender because they have a LiveCD that is a remastered version of Knoppix which is a Live CD based off of Debian Linux. BitDefenders scan engine can also scan Microsoft Windows partitions (to include FULL RW support for NTFS). The only thing missing from my recovery pack is a spyware scanner that runs under linux and will remove windows based spyware. ~ryan

After viewing this thread I noticed that Clam AV came up quite a bit. So I went to their website and went to the news section. From there I saw a link for PC worlds response times articles. Here is the original article in german. Clam AV is #5, but the AV program I use frequently is BitDefender, which is ranked #2. I use BitDefender because they have a LiveCD that is a remastered version of Knoppix which is a Live CD based off of Debian Linux. BitDefenders scan engine can also scan Microsoft Windows partitions (to include FULL RW support for NTFS). The only thing missing from my recovery pack is a spyware scanner that runs under linux and will remove windows based spyware. ~ryan

Check out this: LinuxDefender.

EduKnoppix
Gnoppix
NordisKnoppix
KnoppMyth
Augustux
Condorux
BitDefender
FeatherLinux
Flonix
Overckockix
Knoppix STD
Sulix

They have modified Knoppix to be able to load r/w ntfs drivers. You have to mount the hard drive and scan for the necessary dll's, then they are loaded and the drive remounted r/w.

It is not a lot of work to remaster the CD with those dll's on the CD, then all you need to do, is boot, scan the CD for the files (very quick) and mount your ntfs drives.

Linux Defender has read-write NTFS access: Linux Defender FTP site

2. Offer different proxies with multiple levels of popup/junk filtering that your savvy customers can opt-into.

3. Send out a CD with free versions of Ad-Aware, Spybot S&D, and so on. Or point them to links like the online version of X-Cleaner or one of many online virus scans.

4. You could also be a real saint and figure out how to put most of the important Windows Updates on CD for your dial-up users and have it automatically do its thang. At a minimum, the Service Packs and Security Rollups will make you their hero.

5. ???
6. Profit!!!

We know there isn't a quick fix solution, but 1 and 2 are eminently doable. I personally use a proggie called AdMuncher(.com) and since Dec. 25th its blocked 13,100 ads/popups/etc and supposedly saved me around 102MB of bandwidth. It ain't free, but goddamn its good (and only 157K).

The company I work for also offers a cros platform antivirus solution.
And our Linux version is free.
And we are from the same country (Romania). GeCad was the competition for us. Now that's Microsoft ;-)

check out BitDefender Linux Edition v6.5

Is this one way to penetrate Linux server markets and make some money of out it? So even if you switch from Windows to Linux, you might still be paying to MS one way or another.

BitDefender has a version of their AV suite that runs on linux, and is even free (as in beer) for commercial use (unlike just about every other linux AV scanner.)

Now you won't have to give your money to MS--or anyone else for that matter.

Have any A/V companies deployed products to protect against instant messaging vulnerabilities? I know that Bitdefender have a product that helps to increase your security when running such services, but I haven't heard of similar things from Norton/McAffee.

I always thought this was kinda silly, waiting for the horse to leave before closing the stable. Did anybody not view Instant Messenger traffic, especially once it got into a high level of file transfer interaction, as not being a platform for the deployment of viruses?

Still, this is a social engineering thing more than it is anything else. It's not even really a virus -- it's a piece of destructive code delivered via social engineering. It is not really self-propogating, though, in that it requires the server-side in order to be malicious, or do anything at all.

That seems to me to be stretching "virus" a bit. Maybe "viral meme"? I agree it does spread a bit like a virus, but it actually requires fetching external information.

-l

P.S. Bitdefender are beta'ing a Linux product, by the way. It's not Open, but the beta is a free (as in beer) download. Disclaimer: I'm a fan of that company. ;)