ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    Offline virus scanner - what do you use?

    Scheduled Pinned Locked Moved IT Discussion
    virus
    29 Posts 8 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • coliverC
      coliver @Dashrender
      last edited by

      @Dashrender said:

      LOL nice one @Nic

      No virus scanner is fool proof. If a rootkit manages to get in (or even a non root kit) and get under the AV, the AV is no longer effective. Scanning offline though, assuming the scanner knows about whatever bug might be there, should be able to see it and then you decide how to proceed.

      Nuke it from orbit. If a rootkit gets below the AV that's the only way to be sure nothing else is hiding in there.

      DashrenderD 1 Reply Last reply Reply Quote 0
      • NicN
        Nic
        last edited by

        Makes sense - yeah I'd second the MBAM recommendation in that case. Although if you have a rootkit then you're going to have to boot from some other media to be sure.

        1 Reply Last reply Reply Quote 0
        • DashrenderD
          Dashrender
          last edited by

          Booting from a CD is the plan - that's why it's an offline scan.

          1 Reply Last reply Reply Quote 0
          • DashrenderD
            Dashrender @coliver
            last edited by

            @coliver said:

            @Dashrender said:

            LOL nice one @Nic

            No virus scanner is fool proof. If a rootkit manages to get in (or even a non root kit) and get under the AV, the AV is no longer effective. Scanning offline though, assuming the scanner knows about whatever bug might be there, should be able to see it and then you decide how to proceed.

            Nuke it from orbit. If a rootkit gets below the AV that's the only way to be sure nothing else is hiding in there.

            Agreed, I would nuke a machine I thought even had a chance at a rootkit.

            1 Reply Last reply Reply Quote 0
            • DashrenderD
              Dashrender
              last edited by

              See updated OP.

              1 Reply Last reply Reply Quote 0
              • coliverC
                coliver
                last edited by

                Have you checked the IP's they are talking to? When I was running SW it did the same thing and generally they were legitimate IPs that had been flagged by a third party for malicious adware.

                DashrenderD 1 Reply Last reply Reply Quote 1
                • travisdh1T
                  travisdh1
                  last edited by

                  You mean nobody has a PXE boot to scanner option setup? What are we coming to? Actually, I'm guessing by the time we're considering an off-line scan it's past time to nuke-it-from-orbit.

                  1 Reply Last reply Reply Quote 1
                  • NicN
                    Nic
                    last edited by

                    There's a bunch of good recovery CD options out there. Plus it looks like MBAM has a rootkit scanner now:

                    http://www.techrepublic.com/blog/smb-technologist/two-portable-rootkit-tools-no-smb-should-be-without/
                    https://www.malwarebytes.org/antirootkit/
                    http://www.techsupportalert.com/best-free-rootkit-scanner-remover.htm

                    1 Reply Last reply Reply Quote 0
                    • DashrenderD
                      Dashrender @coliver
                      last edited by

                      @coliver said:

                      Have you checked the IP's they are talking to? When I was running SW it did the same thing and generally they were legitimate IPs that had been flagged by a third party for malicious adware.

                      Yeah, I'm guessing this is probably the situation, but I figure it's better to be safe than sorry and run an outside of norm scan on them.

                      1 Reply Last reply Reply Quote 1
                      • scottalanmillerS
                        scottalanmiller @Nic
                        last edited by

                        @Nic said:

                        What's the use case for scanning offline? Isn't that like asking what brand of condom you like wearing when you aren't having sex? 🙂

                        Quote of the Day right there.

                        1 Reply Last reply Reply Quote 3
                        • DashrenderD
                          Dashrender
                          last edited by

                          So what's your thought on the issue Scott? Should I not even bother? If my running AV seems clean, just move on?

                          1 Reply Last reply Reply Quote 0
                          • scottalanmillerS
                            scottalanmiller
                            last edited by

                            I agree with MBAM as a good secondary scanner. I use that as a "backup" to Webroot. By offline, do you mean booting into a Linux LiveCD and scanning when the Windows kernel is not loaded? If so, yes, that's a good way to go if you are concerned and ClamAV should be fine for that.

                            1 Reply Last reply Reply Quote 2
                            • DashrenderD
                              Dashrender
                              last edited by

                              OK wow, no love for Defender offline here.

                              I guess I'll have to get a live CD with Clam AV on it.

                              dafyreD 1 Reply Last reply Reply Quote 0
                              • dafyreD
                                dafyre @Dashrender
                                last edited by

                                @Dashrender said:

                                OK wow, no love for Defender offline here.

                                I guess I'll have to get a live CD with Clam AV on it.

                                You mean BitDefender?

                                DashrenderD 1 Reply Last reply Reply Quote 0
                                • DashrenderD
                                  Dashrender @dafyre
                                  last edited by

                                  @dafyre said:

                                  @Dashrender said:

                                  OK wow, no love for Defender offline here.

                                  I guess I'll have to get a live CD with Clam AV on it.

                                  You mean BitDefender?

                                  No, MS Defender offline.

                                  windows.microsoft.com/en-us/windows/what-is-windows-defender-offline

                                  dafyreD 1 Reply Last reply Reply Quote 0
                                  • dafyreD
                                    dafyre @Dashrender
                                    last edited by

                                    @Dashrender Never heard of it.... runs off to read

                                    DashrenderD 1 Reply Last reply Reply Quote 0
                                    • DashrenderD
                                      Dashrender @dafyre
                                      last edited by

                                      @dafyre said:

                                      @Dashrender Never heard of it.... runs off to read

                                      I've been using it for at least 2 years, if not more like 4.

                                      dafyreD 1 Reply Last reply Reply Quote 0
                                      • dafyreD
                                        dafyre @Dashrender
                                        last edited by

                                        @Dashrender said:

                                        @dafyre said:

                                        @Dashrender Never heard of it.... runs off to read

                                        I've been using it for at least 2 years, if not more like 4.

                                        Does it work well?

                                        DashrenderD 1 Reply Last reply Reply Quote 0
                                        • DashrenderD
                                          Dashrender @dafyre
                                          last edited by

                                          @dafyre said:

                                          @Dashrender said:

                                          @dafyre said:

                                          @Dashrender Never heard of it.... runs off to read

                                          I've been using it for at least 2 years, if not more like 4.

                                          Does it work well?

                                          It does find things from time to time. I will have to do double scans for the next few times, once with Clam and again with Defender Offline and see if they show different things - though now that i think about that.. that won't work.. as the first AV should get rid of any badies on there.

                                          travisdh1T 1 Reply Last reply Reply Quote 0
                                          • travisdh1T
                                            travisdh1 @Dashrender
                                            last edited by

                                            @Dashrender said:

                                            @dafyre said:

                                            @Dashrender said:

                                            @dafyre said:

                                            @Dashrender Never heard of it.... runs off to read

                                            I've been using it for at least 2 years, if not more like 4.

                                            Does it work well?

                                            It does find things from time to time. I will have to do double scans for the next few times, once with Clam and again with Defender Offline and see if they show different things - though now that i think about that.. that won't work.. as the first AV should get rid of any badies on there.

                                            If you do it a number of times, reversing which one you use first, it would be an indication if one is missing things.

                                            1 Reply Last reply Reply Quote 2
                                            • 1
                                            • 2
                                            • 2 / 2
                                            • First post
                                              Last post