[There's been quite a bit of interest in this post and I've expanded on it quite a bit. Please post any comments or questions to help me improve this guide.
- Neil]
Keith and I have both run into situations where we want to recover a Windows computer by cleaning it up with a Linux Live (bootable) CD distro. This offers several advantages to cleaning up an infected or compromised computer by booting into Windows:
- It prevents the malware, if it exists, from jumping from the infected computer or partition we are trying to fix to the repair partition or boot medium.
- If we boot from a CD, there's actually no way to alter the boot medium, since it's read-only.
- Run Synaptic Package Manager: K > KNOPPIX >Manage Software in KNOPPIX (kpackage)
- Click Search.
- Type f-prot in the Search: field and click [Search]
- Check f-prot-installer
- Click [Apply Changes]
- Open Details on the Applying Changes dialog box by click on the little triangle.
- the F-Prot installer prompts you in the Details box. Select Download and install and select [OK] (use the Tab key and Return to make selections)
- Right-click on the downloaded tgz file and select Extract Here. This should create a directory in your home directory called f-prot.
- cd f-prot/
- sudo ./install-f-prot.pl
- Just accept the default choices during the installation, unless you have a reason not to. The installer will download the latest definition files.
Comments
After going through the process of updating libc6, just to get freshclam to work, I've decided it's much easier just to go with F-Prot. I've updated the original post to describe a reliable way to run the latest F-Prot from a Knoppix 5.1 boot CD.
Thanks!
sudo ./install-f-prot.pl
Neil
In the original post, I suggest using a USB "thumb" drive to keep the F-prot installation files handy, so you don't have to download the installer again, but you still need to check for the latest definitions once f-prot is installed.
If you want to update your actual Knoppix CD with the latest f-prot & virus definitions, so the updated code persists after you reboot, you will have to remaster your Knoppix CD, which is, as they say, non-trivial. Perhaps a topic for another post...
Also, unless you are checking many, many computers at the same time, the chances are that you will need to update the latest definitions the next time you use the Knoppix CD to do a virus scan, and if that's the case, you might as well use the latest f-prot code as well. Again, follow the steps in the main post to update the latest version of f-prot and the accompanying definitions -- but the update only lasts until you shut down.
One other thing to check on is, if you're mostly a Windows person and you run Knoppix or Linux wiithout networking for this exercise (there is wireless in there), can you do all the downloading on a separate Windows PC including current F-prot virus information? Is the download of F-prot itself initially up to date, or do you need to get new virus data to do a proper check? The instructions describe getting virus definitions using the Linux tool. I think F-prot -used- to update their download packages once a week or maybe better, so that you always got a fairly fresh copy.
I'm pursuing this because I've just bought a Vista laptop second-hand and I don't know where it's been.
I know of one deliberately specified non-virus string which has been agreed to test virus scanners safely - here: http://www.eicar.org/anti_virus_test_file.htm But it won't tell you "This virus scanner detects Windows viruses" or Linux viruses or whatever. You probably don't -want- one that discriminates, unless there are only 3 viruses for your model of cell phone and it doesn't have enough RAM to run F-prot's copyright message. But... well, this is already way too long.
You raise some interesting issues about F-prot in your post, above. I can't say I have tested each of the Linux-compatible anti-virus programs to the extent you suggest. My interest in running an anti-virus scan from a Linux boot CD is, as you suggest, to ensure that the virus scan executes in a "known-good" environment; specifically, an operating system and file system that has not been potentially compromised by a virus attack. I recommend F-prot because it's a solid product and well maintained across platforms. There may be other superior products out there -- please post your suggestions here if they also run on Linux.
You asked if F-prot downloads the latest definitions when you install it. It certainly should be current, but it doesn't hurt to double check, so I'd recommend running the f-prot updater after you've installed it, to be sure -- or carefully read the output from the installer to see if you received the latest definition file during the install.
Good luck with your Vista laptop! If you have lots of work to do on that computer to ensure it's reliable, you might also consider setting up a dual-boot configuration with Ubuntu, or a similar easy-to-use Linux variant, to help repair Vista to your satisfaction. With a dual-boot setup, the Linux partitions will be invisible to Windows when you boot into Vista (i.e. safe from viral infection), but you can work with the Windows partitions if you boot into Linux, and use a number of Linux-based tools to maintain or repair the Windows volumes -- a setup that is useful in many circumstances, if Windows ever gets hosed on your laptop, for any reason.
Neil provided good info... I would also recommend the dual-install.
Also, reinstalling vista would be the best choice, but maybe you don't have the license key, or the media, or you want to preserve some of the apps that are on there?
If you need the key, use KeyFinder to find your key, although you have to be careful since it might be a key for an OEM distribution and may not work with the Vista CD you reinstall with.
In any case, it's helpful that Ubuntu will be able to resize your Windows partition for you, to create space so it has room to install.
Regardless, I'm trying ClamAV (using KlamAV as a frontend). So far it's picking up a lot of security threats on the computer. And updating the virus database was a matter of clicking a button.
I have my fingers crossed that it'll work good :)
F-Prot is great but itś not everything, it found 4 backdoors (backdoor2 family) of which the files I deleted, not being anything critical.
So then I wanted to boot into windows to see if anything else was wrong, needed tweaking or fixing (full service when I fix friendś systems) but on boot I found out F-Prot by far doesn get everything, as soon as I booted into windows I got bombarded with those fake anti virus tools (now I know how they got the backdoor though) trying to install trojans and backoors again.
So while F-Prot will find strictly virusses and such it's not as able to find the software responsible for keeping the system infected.
Still thanks for the guide, this will be a standard tool in my repair kit from now on, just hope to find a scanner that will sniff out the crap that keeps downloading and installing these thins as soon as you plug in the utp cable / connect to wifi.
Don't forget to check out "Linux Tips and Tricks "
According to the website, f-prot for linux scans for and detects malware developed for the *nix platform.
I only ask because, I'm running a linux file server (for downloads) and want to implement some malware detection prior to moving the files into production (i.e my media server). My main concern is windows users who might access the files.
Any ideas?
Note that you could set up a cron job for the command line version to automatically update the definition file and also automatically scan a directory on regular intervals -- a good option for a file server.