Click here to get back home

Anti Virus Solutions That Use Their Own Boot CD?
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Anti Virus Solutions That Use Their Own Boot CD? Will 07-02-2008
Posted by Will on July 2, 2008, 1:47 pm
Please log in for more thread options
 Can someone recommend an anti-virus solution that lets you build a boot CD
that will inspect the NTFS file system for trojans or viruses without any
need to boot the OS on the file system you are inspecting?

--
Will



Posted by Doug McIntyre on July 2, 2008, 3:38 pm
Please log in for more thread options
>Can someone recommend an anti-virus solution that lets you build a boot CD
>that will inspect the NTFS file system for trojans or viruses without any
>need to boot the OS on the file system you are inspecting?

Thats not going to be too common, because its not a very effective
model for ongoing A/V protection.

You could probably do something like this by combining together
something like BartPE or WindowsPE boot disks with Clamwin so that can
you can boot (or even PXE boot) off CD and run Clamwin to scan files
on the mounted hard drive.






Posted by FromTheRafters on July 2, 2008, 4:32 pm
Please log in for more thread options
Has Clamwin now gone beyond the mostly email scanning
database? I recall that Clam's original purpose had been to
look for the types of malware that you would expect to find
in the email environment and misused as an all around scanner
by many of the open source proponents.

It shouldn't be any problem inspecting the files, but affecting
them is another matter.

>>Can someone recommend an anti-virus solution that lets you build a boot CD
>>that will inspect the NTFS file system for trojans or viruses without any
>>need to boot the OS on the file system you are inspecting?
>
> Thats not going to be too common, because its not a very effective
> model for ongoing A/V protection.
>
> You could probably do something like this by combining together
> something like BartPE or WindowsPE boot disks with Clamwin so that can
> you can boot (or even PXE boot) off CD and run Clamwin to scan files
> on the mounted hard drive.
>
>
>
>
>


Posted by Will on July 3, 2008, 2:59 am
Please log in for more thread options
>>Can someone recommend an anti-virus solution that lets you build a boot CD
>>that will inspect the NTFS file system for trojans or viruses without any
>>need to boot the OS on the file system you are inspecting?
>
> Thats not going to be too common, because its not a very effective
> model for ongoing A/V protection.

Day-to-day protection has to balance many different issues like
intrusiveness and performance on a system under use. It's very easy to
subvert modern virus checking programs with root kit viruses. The rootkit
simply rewrites kernel functions and reports back to the virus checker only
the data it wants the checker to see.

Booting from a standalone CD is the only approach that guarantees that all
files on the file system can be inspected by an OS and application that is
not under control of a trojan or rootkit. It would be an extremely good
way of checking for hidden files or folders that would otherwise be hidden
from view if the rootkit were active.

It's a shame if no anti-virus vendor has seen to create such a bootable CD.

--
Will



Posted by David H. Lipman on July 3, 2008, 6:21 am
Please log in for more thread options

>>>Can someone recommend an anti-virus solution that lets you build a boot CD
>>>that will inspect the NTFS file system for trojans or viruses without any
>>>need to boot the OS on the file system you are inspecting?

>> Thats not going to be too common, because its not a very effective
>> model for ongoing A/V protection.

| Day-to-day protection has to balance many different issues like
| intrusiveness and performance on a system under use. It's very easy to
| subvert modern virus checking programs with root kit viruses. The rootkit
| simply rewrites kernel functions and reports back to the virus checker only
| the data it wants the checker to see.

| Booting from a standalone CD is the only approach that guarantees that all
| files on the file system can be inspected by an OS and application that is
| not under control of a trojan or rootkit. It would be an extremely good
| way of checking for hidden files or folders that would otherwise be hidden
| from view if the rootkit were active.

| It's a shame if no anti-virus vendor has seen to create such a bootable CD.

| --
| Will



The problem is by nature a CDROM is Read-Only and thus can't be updated easily.
Thus, its
signature would go out of date rather rapidly.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
Multi-AV - http://www.pctipp.ch/downloads/dl/35905.asp



Similar ThreadsPosted
Best practices regarding anti-virus software on production webserver September 12, 2007, 12:46 pm
Second Try: Any Anti Virus Applications That Do Not Require Install to Registry? July 4, 2008, 6:56 pm
bmss.exe running on boot February 26, 2006, 2:56 am
Boot Volume NTFS Permissions for Network Service July 3, 2006, 10:45 pm
KDC service hangs on start + cert error in event log at every boot March 30, 2007, 2:58 am
Virus protection on servers? December 14, 2007, 3:57 pm
Does Windows Server 2003 need Mcafee virus scan? January 4, 2006, 11:47 am
Virus cleanup - fix compromised windows firewall settings August 21, 2007, 11:19 am

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap