Slashdot Mirror

An AC coughed up this:

Trinity Rescue Kit -- http://trinityhome.org/
Comes with ddrescue and smartmontools, along with a lot of other useful software for working with Windows systems.

Sounds quite useful. Thanks to both of you!

Trinity Rescue Kit

Comes with ddrescue and smartmontools, along with a lot of other useful software for working with Windows systems.

There are a couple testing files and sites that exist for testing antiviruses that might be of interest. The one that I've used to ensure anti-virus software was functioning was EICAR which is a simple text file that virus definitions recognize but which does not actively do anything. This is useful for demonstrating that software is working, what a virus response looks like and how to remove a virus if it is found. Since it does nothing, it is only useful as a test and doesn't really get into how to deal with a fully compromised system.

An alternative is Spycar which will perform actions targeted in demonstrating browser exploits. It wouldn't be available in a non-internet lab, but you might be able to adapt the links there by putting the files up on an intranet.

http://www.spycar.org/Spycar.html referenced at http://www.pcworld.com/article/125138/put_your_antispyware_apps_to_the_test.html

http://www.eicar.org/anti_virus_test_file.htm referenced in a variety of places, including http://www.sophos.com/pressoffice/news/articles/2003/01/eicar.html

Removal scenarios vary according to how messed up a machine is by an infection. I usually use Trinity Rescue Kit as a first test for computers I don't trust or know have virus issues.

TRK: http://trinityhome.org/

I use MalwareBytes from http://www.malwarebytes.org/ in some cases and found it to be more effective than many of the other solutions, even in the free version.

I haven't seen anyone post this yet: http://trinityhome.org/

Update it prior to write protecting it, and assuming you can boot those machines from USB as well, boot them and go to town. It has saved many a friend/family machine I have been forced to support for free.

Tm

Get the ISO from http://trinityhome.org/Home/index.php?wpid=1&front_id=12 for the Trinity Rescue Kit. Run it. Update it and save the updated ISO image. Burn that to a CD and give it to your friend. He can run it and disinfect his computer without an Internet connection. Give him an updated CD every month.

As far as cleaning up after this crap, I've been relying on Trinity a lot. LiveCD, boots, mounts and scans. http://trinityhome.org/Home/index.php?wpid=1&front_id=12

The only problem is, you need some Linux skills to use it. Last time I applied it, it missed the Windows partition and I had to go in and manually mount it.

If I were better with rolling Linux LiveCDs, I would add more scanners and set it up to run out of X

I thoroughly recommend the Trinity Rescue Kit precisely for this purpose and for repairing and/or cloning NTFS partitions from a bootable Linux CD.

And, no, I'm nothing to do with any of the team who develop it, I came across it pretty much by accident and have used it ever since.

...will take the system offline every so often and scan with multiple antivirus programs in a different OS environment, like linux.

How does scanning a running operating system for viruses even cause a dent? Most viruses that I've ever seen have a tendency to hide and/or protect itself from antivirus software. The software is usually completely helpless on an already infected system.

I recommend an offline scanning solution like TRK for an already infected system.

Ideally I would run the scan by unplugging the network cable and booting from directly the malware-scanner CD. Unfortunately nobody makes such a thing

TRK? Admittedly, the virus scanners it can pull down and run probably aren't as ideal as dedicated anti-malware/spyware software would be, but it's a start.

This is a great all-in-one recovery kit on a single CD that also supports being loaded on a USB pen drive. The ISO image clocks in at around ~150Mb, is a pretty complete linux (based on Mandrake) with built-in sshd, smb support, partimage, and a good double-handful of useful recovery tools. It's designed for cross-platform support - the full suite of ntfs-tools are included as well. I have been using it to clone baseline builds of my production systems at work and it is excellent. Fast boot and a good selection of boot options as well. Can be had at http://trinityhome.org/. Check out the latest beta for even more functionality.

Yes, Knoppix is a great swiss army knife Live CD, and Damn Small Linux and MEMtest86+ are probably must-haves, but I'd like to suggest one that I haven't seen here yet.

The Trinity Rescue CD. It's a nice (free as in beer) linux rescue CD that includes some interesting extras, like the ability to download fresh signature updates and run 4 different AV packages (it includes ClamAv, F-Prot, Grisoft AVG and BitDefender). It's got all the other standard rescue stuff for windows and linux, glued nicely together in both a (mostly) menu driven environment, or CLI.
Get your fresh hot copy at http://trinityhome.org/

(I'm not affiliated with the project, just very pleased with what this group has been able to put together.)

Most Linux distributions may be rebooted into single-user mode in a moment, and (potentially) trojaned or otherwise mucked with. (Since Linux has good support for booting from a CD, attackers may also just boot from a CD.) With Linux, an administrator really needs to disable CD booting, lock the BIOS, and configure the bootloader (grub or lilo) to either disallow choosing any non-standard arguments when loading Linux or password-protect the simple process of rebooting the computer.

I don't suppose you have ever heard of the Trinity Rescue CD? You stick it in a Windows machine's CD drive, reboot, reset whatever local user account's password that you so desire (default and recommended account is the local admin), then just reboot and voila -- admin rights to windows. Thus, in this respect, Linux is no different from Windows. Admittedly, I haven't tried this with machines that do not allow local logins, but imagine the trouble someone could cause if they got into your server room (think "domain controller").

I do agree with many of your other points however.

The Trinity Rescue Kit 1.1 is a Linux distribution based on Mandrake 9.1 binaries. It is designed to rescue/repair/prepare dead or damaged systems, be it Linux or Windows. It has networking capabilities like ssh, samba and ftp and supports about every network card, disk controller and USB controller. You can use it to repair a Windows 2000 or Windows XP system by setting the checkdisk flag or editing the registry or just reset the administrator password (or any other user). You can even undelete files from an ntfs, ext2 or fat partition.