Slashdot Mirror
CDROM-Based Virus Scanners?
cheros asks: "Pretty much every virus checker I've seen requires installation of a couple of MB worth of data on the HD. However, in a controlled or accredited environment (say, a hospital) installation of external software can invalidate the build, and the checking process can adversely affect timing (in, say, plant control systems), so I'm looking for a virus checker that works from a CD. This obviously means the CD needs updating when new signatures come out, but at least it's a 'hands off' sweep of the system that can be done during maintenance down-time (and assures me that the virus software itself can't compromised). The only workaround I have at the moment is that critical system files can be checksummed to prove integrity (MD5 is your friend ;] ). That's OK for the systems that are fairly static (no, not blue screened, less data changes on the disk =] ), but systems where config data changes (say, a DDNS) are less easy to check. It's mostly a Windows problem (with &^$$& locked files being a pain), but the same situation can arise on any platform. Got any ideas?"
Although i am unfamiliar with any CD based anti-virus software, you could always install the software onto a removable usb harddisk, even a keychain drive and run the software from the drive, leaving the primary disk more or less untouched (hopefuly less).
Yawn.
try http://www.openantivirus.org .. It's free.. it's open source.. it's in java..
Stick it on the cd with a (windows/linux/mac) jvm.. and you're set to go.
I have openantivirus running on my mail server right now... catches almost everything..
I believe there's a "C" version called clamscan out there.... not sure if it'll compile under anything but linux.. but you can always try.
ChiefArcher
I've got a copy of Norton Systemworks 2001 at work that states on install, that you should boot to the cd-rom and have it do a virus check before you install the software (Norton Antivirus is included in this suite...)
:) (slightly ot, I know)
I've not used it yet; the only risk I would say you'd run is if you have a virus that is not detected with the CD build of the virusscan... Pretty hard to do updates to read-only media.... but for a general sweep of the machine, you'd be good to go.
Maybe there's a way to "repackage" the bootable portion of the cd / virus definitions, and go that route? I'm sure Norton has had requests for this before, and it wouldn't take much time talking with their support (never had to contact them myself) to see if this is the case...
We're in the same boat, though... Validated systems; since I work in Network Architecture, one of the problems we run into is we can't put ANYTHING on servers that isn't validated (i.e. packet sniffing/analyzing agents, etc.) I see their point, so in the end we just mirror ports
Karnal
You could probably use the DOS or Linux version of F-Prot. It doesn't need to write anything, and it has some nice command-line options for automated scanning etc.
With a little effort, you can even fit the DOS version on a single floppy. You'll need to store it compressed, and uncompress it to a ramdisk when booting.
I've used a laptop with Norton AntiVirus installed to check the hard disks/files of other systems, maybe something simple-n-stupid like this would help?
"1984" was ment to be a warning, not a guidebook. You hear that Kim Jong-il!? BushCo?!
Since the scanner can also be run manually, you could install updated definitions on a floppy disk with the tab set.
That's just off the top of my head; I'm sure The Best Friend Of The WWW could render gallons more assistance.
BD Phone Home!
Shameless plug. Like you weren't expecting it.
Every Windows based virus scanner I've known has an option for this. Norton AntiVirus can boot to the CD or make floppy disks, I think the newer versions can use a floppy disk for later virus definitions. Mcafee can do the same, I believe. I know it can run off floppies. So can F-Prot.
This is quite obvious. Every virus scanner in my memory has had an option to boot off of the CD or create a boot floppy (which can be write protected in the same fashion as all floppies). The CD boots, can do a scan (automatically if you configure autoexec.bat to do so). You can re-burn the cd by placing new definitions on the cd, or tell the program to go get the definitions from another source (ls-120 drive, hard disk, etc.). This has all been possible with norton antivirus since version 2000 (probably earlier. i just never checked)
-- If you try to fail and succeed, which have you done? - Uli's moose
Norton A/V comes as a bootable cdrom, and you can make a set of rescue disks that you can use. I suppose you could also make a bootable cdrom (Nero does that) with the vdefs on it, and use some autoexec file to do a batch scan of the system using the latest defs from the CD. So simple even a janitor could do it!!!
-D
I used to work for a company in the SouthEastern United States, currently called Avid Solutions, Formerally called Carolina Instermentation Corp/Electrical Maintence Overflow Comp. (cic/emoc). Every Control System that I have ever seen them put together was setup a perticular way.
1. Locked down OS. In NT, this involved Policies, in most cases, Auto logins, and quite a bit of registery editing.
2. Seperated Network. The control networks were allways on their own network. In many cases, a main network, and a backup network.
3. No internet access.
4. No access to the floppy/cdrom unless your an administrator, hell, explorer dosen't even load, only the control application.
Perhaps you need to look at your setup and make some changes if your worried about viruses.
damn i cant spell today... I guess i need sleep
It will boot and mount most any file system: Microsoft FAT 16, FAT 32, VFAT, NTFS, Linux ext2, ReiserFS and UMSDOS, IBM OS/2 HPFS, FreeBSD, OpenBSD, Solaris, and Unix UFS, CD-ROM ISO9660, Minix, FreeVxFS, Veritas VxFS, System V, Xenix, V7, and UDF.
Vexira Antivirus Rescue Risk
The VARD is free BTW.
I forgot to add that VARD can be downloaded as a .ISO image or a 4 diskette set. You'll need to run the SFX diskette tool on a Windows box to create the diskettes because we use WinZip to create the SFX application but after that it will act just like the CD-ROM version. I prefer the CD-ROM version myself and give my friends a wallet size "card disk" for there field trouble shooting. It fits nicely in shirt pockets :-)
Vexira website
The Web is like Usenet, but
the elephants are untrained.
I know that similar posts have been made, but I don't think this can be expressed enough!!!
You shouldn't need AV software in the systems you describe. These should not require direct access to an untrusted network...there is no reason why someone should be installing their own software on the system...and the systems should be designed as such (no direct access...a locked cabinet is a good idea here, and secondary/tertiary networks for workstation access to data)...if you really must have mission critical systems open to viruses, and you are using standard peecee hardware, you could always try an Antivirus PCI Card.
I guess this might be another advantage of using Linux for mission critical apps...chances are the employees don't have access to software...
F-prot antivirus can fit on 3 write-protected floppies or a bootable CD-ROM. Its free for personal use, and easy enough to update by downloading new definitions from its website. Its available for both DOS and Linux.
If you have a virus threat problem, I assume that you are connected to an external (out of your control) network. If this network happens to be the internet (most likely), just try Symantec's Security Check. It scans for viruses over the net (with a bit of ActiveX magic... It seems that M$ security misses can be useful sometimes ;-P)
Any enterprise virus protection product can do this w/o installing files on remote boxes. Failing that, scan the admin shares (C$/D$/etc) from a central server manually. The only files you won't be able to access are those that are exclusive locked by the OS and they can't be infected by any virus anyway.
It still amazes me to this day the level of ignorance expressed by people who are responsible for admin duties on Windows machines.
But this affect the timings he was talking about.
"However, in a controlled or accredited environment (say, a hospital) installation of external software can invalidate the build, and the checking process can adversely affect timing (in, say, plant control systems), so I'm looking for a virus checker that works from a CD.
The logic behind his requirement is flawed:
Any non-acredited software can affect the build, Even anti-virus software that is not installed on that build. i.e. many antivirus software write checksums somewhere on the HD. I people can run such software you have a problem anyway in such an environment.
You can install most antivirus software in a non-interfering mode, only scan wheren you press the scan button. So why not put in on HD or a (read only) central server?
Opening up C$ & D$ would be a bad idea, but is is possible.
The only files you won't be able to access are those that are exclusive locked by the OS and they can't be infected by any virus anyway.
Since they can be updated by update software, virus software can update those files as well.
In the end i think he is a (l)user that cannot install software, but wants to virus check his PC anyway. (read between the lines!)
Not sure I agree with your assumption, the poster might be more familiar with Unix/Linux where vcheck problems are different to manage (though not absent). Sort of the reverse of Windows sysadmins asked to switch to Linux :-).
.. err, that's it ;-).
Booting from CD has the added advantage that the target drive/array to check can be mounted read-only (to prevent writes and thus invalidate accreditation - and check those locked system files), but that needs a little bit of messing around.
It's IMO not a bad idea to check integrity occasionally, it only takes one idiot with an infected laptop to jack into the network to make a complete mess - after all, accreditation tends to slow down the update process considerably, so you're always behind with security patches.
Of course you ought to hang such an idiot by the private parts, but that assumes
a) you catch he/she/it doing it (or have IDS data to identify the culprit)
b) he/she/it still has private parts to be hung by and
c) the damage was indeed accidental (think that one over for a minute).
Don't tell me that it should never happen. I've seen enough over the years not to assume anything.
Process and education help, but won't cure stupidity.
--
Users. Can't live with them,
http://www.free-av.com/ave.htm
Of course this only works for Fat/Fat32.
I don't know of any that would scan NTFS. You'd have to have some munged version of NT/Win2k boot off a CD and then run a virus scanner.
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin
Opening up C$ & D$ would be a bad idea, but is is possible.
:)
Why exactly do you think those shares exist to begin with? How do you think domain wide backups are performed? Those shares are exactly the ones used by enterprise anti-virus packages for scanning individual machines.
Since they can be updated by update software, virus software can update those files as well.
If the OS has the files locked for exclusive access nothing can update them except for the process that has them opened - period (or else it would be called psuedo-exclusive access).
Files opened in this manner are typically data files (registry hives, database files, etc) and aren't subject to conventional virus infection anyway.
In the end i think he is a (l)user that cannot install software, but wants to virus check his PC anyway. (read between the lines!)
You are probably correct and I was a bit harsh. Still, he should be taking this up with his IT department and not trying to go it alone.
2. A floppy disk with the latest virus definitions on it.
The Norton AntiVirus CD automatically checks the floppy drive for the latest virus definitions when you boot from it, otherwise it uses the outdated ones on the CD.
Caution: MAJOR conflict of interest. The writer is an anti-virus consultant who will lose money if there is an open source alternative.
In cases such as schools, you can't unplug it. In the case I'm talking about, the computer is only used to run a piece of machinery, or a set of chemical reactors. The system for all intents and purposes is unplugged because it does not need to be plugged in.
I imagine that a "system for all intensive purposes" would be a gamer's box... but I digress.
The other posters are missing the point that if a system doesn't need access, then don't grant it access.