LinuxQuestions.org
Welcome to the most active Linux Forum on the web.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-08-2009, 12:34 PM   #1
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Rep: Reputation: 16
Linux based offline scanning of 2000/XP machines


Have been searching this for a few days but have come up empty.

At work, I have a network of mostly 2000 and XP boxes. I'm looking for something that can be integrated into, for example, slax, and scan for malware in general. I'd like it to apply to as many forms of malware as possible.

I know about about clamav, and I intend to use it too. But it seems targeted at specifically AV running on mail servers. I need something that could catch things like antivirus 2009 and related crap. And I'd prefer to be able to do it all from a live cd in one fail swoop, rather than having some things on linux live cd, some on windows live cd, some that have to be run from within windows, etc.

Anyone know of good software for this? Thanks.
 
Old 01-08-2009, 01:09 PM   #2
asymptote
Member
 
Registered: Mar 2008
Posts: 236

Rep: Reputation: 37
Backtrack has some great antivirus software that is available on the live cd/usb. I worked at a helpdesk and some people's windows machines were so infected that we couldn't put them on the campus network. We ran BT3 and used the antivirus utility and it cleaned them up pretty well.

If you're looking for something like a centralized linux-based antivirus controller that pushes out av updates to clients I'm not immediately sure what you would use w/o googling.
 
Old 01-08-2009, 01:17 PM   #3
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
No, just looking for something simple to run off a live cd. We already have an AV server, and I'm not the admin anyway, so I don't make those decisions

Thanks for the Backtrack tip, I will check it out.
 
Old 01-08-2009, 01:59 PM   #4
farslayer
LQ Guru
 
Registered: Oct 2005
Location: Northeast Ohio
Distribution: linuxdebian
Posts: 7,243
Blog Entries: 5

Rep: Reputation: 190Reputation: 190
As adirect answer to your Question.. Most malware scanners I have seen are Windows based, and then you have ClamAV which is Linux or Windows.

http://www.microsoft.com/downloads/d...displaylang=en
How to Combat Malware Using Windows PE
The Malware Removal Starter Kit provides tested guidance to help IT Generalists combat malware attacks against small- and medium-sized organizations. Using the Windows Pre-installation Environment (Windows PE) in combination with free anti-malware scanning programs, the kit provides a low-cost, effective strategy that you can use to vanquish malware attacks.
http://searchenterprisedesktop.techt...265238,00.html



Ultimate Boot CD is another LIVE CD Option for cleaning Windows machines. Not Linux, but
http://www.ubcd4win.com/

Code:
Anti-Spyware Tools
aSquared Free 	3.1.0.9 Scans remote hard drives for spyware, etc.
AdAware 	1.06 SE Scans remote hard drives for spyware, etc.
AVG AntiSpyware 	  	 
CWShredder 	2.16 	Finds and removes traces of CoolWebSearch hijacker.
EzPCFix 	?? 	Helpful tool when trying to remove viruses, spyware, 
                        other troublesome advertising programs, and malware from your computer.
HiJackThis 	2 	Helpful tool when trying to remove viruses, spyware, 
                        other troublesome advertising programs, and malware. Not as good as EzPCFix.
Rootkitty 	? 	Very new tool in development, searches a system for rootkits
Spy Bot 	1.5.2 	Effectively scans remote hard drives for spyware/malware!
Super AntiSpyware 	Effectively scans remote hard drives for spyware/malware!
WinSock Fix 	1.2 	Used to repair WinSock errors

AntiVirus Tools
AVG Free 	7.5.503 Excellent full featured freeware AntiVirus software
AVPersonal 	7.04 	Good full featured freeware AntiVirus software
Avast! Tool 	1.0.211 Scans for a limited number of viruses
Kaspersky VRT 	  	Free virus Removal Tool from Kaspersky
McAfee Stinger 	2.6.0 	Scans for a limited number of viruses


My approach is a bit different.
==================================

for scanning remote windows machines for malware I use HFNetChkPro http://www.shavlik.com/
No it's not Linux based, no it's not a live CD, No it's not free. There are license fees involved. but I'm not going around to every machine on the network one at a time to scan them, and I know of no GNU centralized malware scanner for Windows. What this program costs me for a year is more than covered, just by using it to scan for and push out updates to all the Windows machines on the network.

With This program I can scan EVERY Single PC on my network at the same time for Missing patches or Malware, then do the remediation for all the machines at once, instead of one at a time.

Keep in mind that most free Windows atni-virus/malware applications are free for home use but NOT for commercial use.


An even better investment was a gateway box that simply blocks that garbage before it enters the network.
I currently use a Fortigate 100A box from Fortinet. http://www.fortinet.com/
These units are based on Open Source Software but for my $719.00 Support fee for this year(renewed today),
I get:
AV updates,
Malware Updates,
Web site categorization lists for content filtering,
Virus and malware scanning of http, SMTP, POP, ftp, & other traffic as it comes across the wire.
It can do SPAM filtering,
The hardware is covered under that fee as well so if the appliance dies it gets replaced.

Purchase price on this unit was around $1400.00 initially.

Once this Fortigate box was put in place I thought my centralized AV reporting system had broken.. there were NO entries in the management panel any more.. took me a few to realise all the bad stuff was being blocked before it ever reached the workstation.

Since this solution was implemented 3 years ago, I haven't seen a SINGLE piece of malware in my network.
(keep in mind there is also Desktop level protection)


If you add up the cost of manually scanning and cleaning every PC in your network in just TIME ALONE you will exceed the purchase price of many of the available commercial solutions.


Yes I love Free Software, but I will not pass over a reasonably priced commercial solution that saves me a TON of time and effort.

Last edited by farslayer; 01-08-2009 at 02:04 PM.
 
Old 01-08-2009, 05:52 PM   #5
shakezilla
Member
 
Registered: Jun 2005
Location: U.S.
Distribution: xubuntu 8.10, linux 2.6.27-11-generic
Posts: 78

Original Poster
Rep: Reputation: 16
farslayer, thanks, I'll be looking at those too.

I know we just recently got a cisco box that I think is doing a lot of the same things that your fortigate is doing. This was very recent, so I don't yet how well it works. Given that, I don't think I'll be able to swing any purchases.

I'll definitely look into ubcd4win and the MRSK though. I've used the original ubcd before, but had no idea about the Win PE version. Thanks.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Problem on windows machines -- Linux Based Solution zaheer Linux - Distributions 3 02-05-2008 09:02 AM
Windows 2000 machines with a Linux Server tubatodd Slackware 2 03-30-2007 02:54 PM
Authentication of Linux machines from windows 2000 domain controller jomy Linux - Networking 1 12-05-2004 02:25 AM
Linux based DVR machines chuone LQ Suggestions & Feedback 1 11-24-2004 08:46 AM
64 bit linux/cygwin for opteron based machines. loanstocker Linux - General 2 04-28-2004 03:26 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 08:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration