Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

CDROM-Based Virus Scanners? 48

Posted by Cliff from the hands-off-bug-hunting dept.
cheros asks: "Pretty much every virus checker I've seen requires installation of a couple of MB worth of data on the HD. However, in a controlled or accredited environment (say, a hospital) installation of external software can invalidate the build, and the checking process can adversely affect timing (in, say, plant control systems), so I'm looking for a virus checker that works from a CD. This obviously means the CD needs updating when new signatures come out, but at least it's a 'hands off' sweep of the system that can be done during maintenance down-time (and assures me that the virus software itself can't compromised). The only workaround I have at the moment is that critical system files can be checksummed to prove integrity (MD5 is your friend ;] ). That's OK for the systems that are fairly static (no, not blue screened, less data changes on the disk =] ), but systems where config data changes (say, a DDNS) are less easy to check. It's mostly a Windows problem (with &^$$& locked files being a pain), but the same situation can arise on any platform. Got any ideas?"
This discussion has been archived. No new comments can be posted.

CDROM-Based Virus Scanners? More

CDROM-Based Virus Scanners?

Comments Filter:

  • Try a usb or firewire harddisk (Score:3, Insightful)

    by Stigmata669 ( 517894 ) on Thursday September 19, 2002 @09:36PM (#4294354)
    Although i am unfamiliar with any CD based anti-virus software, you could always install the software onto a removable usb harddisk, even a keychain drive [thinkgeek.com] and run the software from the drive, leaving the primary disk more or less untouched (hopefuly less).
  • try http://www.openantivirus.org [openantivirus.org] .. It's free.. it's open source.. it's in java.. Stick it on the cd with a (windows/linux/mac) jvm.. and you're set to go. I have openantivirus running on my mail server right now... catches almost everything.. I believe there's a "C" version called clamscan out there.... not sure if it'll compile under anything but linux.. but you can always try. ChiefArcher

  • Norton Systemworks 2001 (Score:3, Informative)

    by karnal ( 22275 ) on Thursday September 19, 2002 @09:49PM (#4294415)
    I've got a copy of Norton Systemworks 2001 at work that states on install, that you should boot to the cd-rom and have it do a virus check before you install the software (Norton Antivirus is included in this suite...)

    I've not used it yet; the only risk I would say you'd run is if you have a virus that is not detected with the CD build of the virusscan... Pretty hard to do updates to read-only media.... but for a general sweep of the machine, you'd be good to go.

    Maybe there's a way to "repackage" the bootable portion of the cd / virus definitions, and go that route? I'm sure Norton has had requests for this before, and it wouldn't take much time talking with their support (never had to contact them myself) to see if this is the case...

    We're in the same boat, though... Validated systems; since I work in Network Architecture, one of the problems we run into is we can't put ANYTHING on servers that isn't validated (i.e. packet sniffing/analyzing agents, etc.) I see their point, so in the end we just mirror ports :) (slightly ot, I know)

  • F-PROT (Score:3, Informative)

    by reynaert ( 264437 ) on Thursday September 19, 2002 @09:54PM (#4294448)

    You could probably use the DOS or Linux version of F-Prot [f-prot.com]. It doesn't need to write anything, and it has some nice command-line options for automated scanning etc.

    With a little effort, you can even fit the DOS version on a single floppy. You'll need to store it compressed, and uncompress it to a ramdisk when booting.

    • This is the program I use for scanning. Built a boot cd with a cdrw and floppy emulation using the dos version of f-prot. With the right drivers you could probably even get it to scan NTFS partitions. Update the definitions when needed. Works great. Just requires to boot from the CD.
      • Great scaning program, and I use it as well, but from time to time I'm using it on old computers, that can't read CDRW. The program does not have an option to take the definitions from another dir. I think that this could be the best solution to this prob.

    • Re:F-PROT (Score:2, Informative)

      by Tux2000 ( 523259 )

      The guys and girls of the german c't magazine [heise.de] combined toms rescue boot disk [toms.net] with F-Prot for Linux and pressed it onto a CDROM shipped with the issue 13/2002 [heise.de]. You can order this issue for 3 EUR + shipping (1 EUR is round about 1 US $).

      If you can get internet access with that CDROM, you can even update the scanner and the data files. (And as a nice bonus, you get 600 MBytes Freeware and Shareware.)

      Tux2000

    • This sounds like an excellent suggestion-- build a bootable CD-ROM which auto-scans all the local drives. In addition to not requiring any installed software, booting off known virus-free media guarantees that you'll find all those nasty stealth viruses that like to hide in memory.
  • I've used a laptop with Norton AntiVirus installed to check the hard disks/files of other systems, maybe something simple-n-stupid like this would help?
  • Would have led to Symantec [symantec.com] who ship their Norton Antivirus CDROMs as bootable CDs that can automatically check the filesystem(s) of the hard drive(s) with as little as one or two carriage returns.

    Since the scanner can also be run manually, you could install updated definitions on a floppy disk with the tab set.

    That's just off the top of my head; I'm sure The Best Friend Of The WWW [google.com] could render gallons more assistance.

  • Every Windows based virus scanner I've known has an option for this. Norton AntiVirus can boot to the CD or make floppy disks, I think the newer versions can use a floppy disk for later virus definitions. Mcafee can do the same, I believe. I know it can run off floppies. So can F-Prot.
  • This is quite obvious. Every virus scanner in my memory has had an option to boot off of the CD or create a boot floppy (which can be write protected in the same fashion as all floppies). The CD boots, can do a scan (automatically if you configure autoexec.bat to do so). You can re-burn the cd by placing new definitions on the cd, or tell the program to go get the definitions from another source (ls-120 drive, hard disk, etc.). This has all been possible with norton antivirus since version 2000 (probably earlier. i just never checked)
  • Norton A/V comes as a bootable cdrom, and you can make a set of rescue disks that you can use. I suppose you could also make a bootable cdrom [cdrfaq.org](Nero [nero.com] does that) with the vdefs on it, and use some autoexec file to do a batch scan of the system using the latest defs from the CD. So simple even a janitor could do it!!!

    -D

  • Control Systems (Score:4, Insightful)

    by LWolenczak ( 10527 ) <julia@evilcow.org> on Thursday September 19, 2002 @10:32PM (#4294616) Homepage Journal
    I used to work for a company in the SouthEastern United States, currently called Avid Solutions, Formerally called Carolina Instermentation Corp/Electrical Maintence Overflow Comp. (cic/emoc). Every Control System that I have ever seen them put together was setup a perticular way.

    1. Locked down OS. In NT, this involved Policies, in most cases, Auto logins, and quite a bit of registery editing.
    2. Seperated Network. The control networks were allways on their own network. In many cases, a main network, and a backup network.
    3. No internet access.
    4. No access to the floppy/cdrom unless your an administrator, hell, explorer dosen't even load, only the control application.

    Perhaps you need to look at your setup and make some changes if your worried about viruses.
    • damn i cant spell today... I guess i need sleep
    • 3. No internet access.
      Would you care to accompany me on a routine run of some of our customers' networks today and inform them that in the interest of virus protection, we will be removing their Internet routers?

      It's said that the safest way to protect your computer from [viruses/cracking/information theft/etc.] is to unplug it, but how practical is that here in the real world?

    • In agreement with the other responders, this sounds like crap to me. Installing a complete lockdown on machines tends to p*ss off employees, and just generally cause problems. Locking down an existing open network is a pain in the butt to admins too, every time new software has to be installed the admin has to be called in.

      I'm currently working in a local school district, and this is the only siutation I've found lockdowns useful, since kids intentionally tend to cause crap or download porn etc. In a business with reasonable adults, you can at least hope/expect that they won't be causing deliberate damage to the machines.

      This shameful plug should be used to plug um... nevermind - phorm
      • In cases such as schools, you can't unplug it. In the case I'm talking about, The computer is only used to run a piece of machinery, or a set of chemical reactors. The system for all intensive purposes is unplugged because it does not need to be plugged in.
  • I work for Central Command the company that produces Vexira Antivirus so be careful you might find a few biased statements here :-) We have Vexira Antivirus Rescue Disk (VARD) which is a bootable CD-ROM and diskette virus scanner that runs entirely in RAM. It's based on a debian micro kernel and includes a easy to follow menu. It can update the latest virus database and virus scanning engine also! Yes, even if you are using the CD-ROM version. You just need to download updates onto a floppy and select the update option on the main menu. VARD will pull them into RAM.

    It will boot and mount most any file system: Microsoft FAT 16, FAT 32, VFAT, NTFS, Linux ext2, ReiserFS and UMSDOS, IBM OS/2 HPFS, FreeBSD, OpenBSD, Solaris, and Unix UFS, CD-ROM ISO9660, Minix, FreeVxFS, Veritas VxFS, System V, Xenix, V7, and UDF.

    Vexira Antivirus Rescue Risk [centralcommand.com]

    The VARD is free BTW.

  • Why??? (Score:5, Insightful)

    by OneFix ( 18661 ) on Thursday September 19, 2002 @11:23PM (#4294851)
    I know that similar posts have been made, but I don't think this can be expressed enough!!!

    You shouldn't need AV software in the systems you describe. These should not require direct access to an untrusted network...there is no reason why someone should be installing their own software on the system...and the systems should be designed as such (no direct access...a locked cabinet is a good idea here, and secondary/tertiary networks for workstation access to data)...if you really must have mission critical systems open to viruses, and you are using standard peecee hardware, you could always try an Antivirus PCI Card [rd-comp.com].

    I guess this might be another advantage of using Linux for mission critical apps...chances are the employees don't have access to software...
    • ...all it takes is someone with a boot sector virus on a floppy to insert it into the otherwise-locked down system and cycle the power, to infect the machine. While systems for some time have been able to have a different boot order than FD0->HD0->HD1, there are older systems that don't allow this...
      • ...all it takes is someone with a boot sector virus on a floppy to insert it into the otherwise-locked down system and cycle the power, to infect the machine.
        Then remove the floppy drives. If someone needs access to a floppy, they can take it to an administrator who can move files as needed (after virus checking). Remember, this is a hospital production system - people shouldn't need routine access to a floppy drive.
        • Removing both floppy and cdroms is SOP with me. Since I did that to everyone's boxes, I've got more time for other stuff.
      • How can they insert a floppy through a locked cabinet?

  • F-prot antivirus can fit on 3 write-protected floppies or a bootable CD-ROM. Its free for personal use, and easy enough to update by downloading new definitions from its website. Its available for both DOS and Linux.

  • If you have a virus threat problem, I assume that you are connected to an external (out of your control) network. If this network happens to be the internet (most likely), just try Symantec's [symantec.com] Security Check. It scans for viruses over the net (with a bit of ActiveX magic... It seems that M$ security misses can be useful sometimes ;-P)
  • http://www.free-av.com/ave.htm

    Of course this only works for Fat/Fat32.

    I don't know of any that would scan NTFS. You'd have to have some munged version of NT/Win2k boot off a CD and then run a virus scanner.
  • 1. A Norton AntiVirus 2002 CD
    2. A floppy disk with the latest virus definitions on it.

    The Norton AntiVirus CD automatically checks the floppy drive for the latest virus definitions when you boot from it, otherwise it uses the outdated ones on the CD.

Slashdot Top Deals

"The medium is the massage." -- Crazy Nigel

Close