Good USB key scanner? - Page 2

incynr8 · 11-08-2007, 02:56 PM

V11 up might do it, V8 and down only have 'floppy' access controls.
Although I understand the logic of the request, it's inefficient to have entire volumes of removables scanned on connection, rather than at infected file execution/modification/access, which Norton(or any AV) should be doing regardless of file source.
a 2gbg usb stick=fast scan a 1tb eSATA drive, long scan.

CrazyBoy78 · 11-08-2007, 03:05 PM

Quote:

Originally Posted by incynr8

Norton Corp should pickup on EVENT, such as file access or local execution. It will not scan the entire volume upon mounting.

Yep. The reason I brought this all up was because I was trying to help a user out by using some software on my memory key (before I knew about the rootkit). Then for some dumb reason I plugged it into my workstation later on and gave myself the rootkit. Then I had to format my workstation and the key (on a soon-to-be-returned-to-IBM-rental-laptop). My workstation has SAV Corp. on it but it didn't even flinch. Very annoying.

I just kept wishing I could have a bit of software that could act as an airlock of sorts where I could scan the contents with whatever I needed.

Jefe · 11-08-2007, 03:42 PM

A good way to test and see if a virus scanner will check USB Keys is to download the EICAR test files from eicar - Home and put them on the key. Then plug the key in.

We use Avast! on our student lab machines, and it detects them when the key is plugged in.

Wycke · 11-08-2007, 04:15 PM

Quote:

Originally Posted by incynr8

Norton Corp should pickup on EVENT, such as file access or local execution. It will not scan the entire volume upon mounting.

Actually, since version 10, the Mac version does, by default, scan locally-mounted volumes (CDs, DVDs, flash/USB/firewire drives, etc) upon insertion/mounting. Network shares are not scanned. It also scans for and detects Windows-based threats in addition to the few legitmate Mac OS threats that are out there. Hooray, Mac!

incynr8 · 11-08-2007, 04:17 PM

thanks, I'm stuck on V8 on the windows land here.
I run ClamAV on my boxes, mostly to monitor files living on smb shares.

Jefe · 11-08-2007, 04:19 PM

Quote:

Originally Posted by Wycke

It also scans for and detects Windows-based threats in addition to the few legitmate Mac OS threats that are out there. Hooray, Mac!

Some day, someone, will create the ultimate destructive Mac virus...and that day I'll laugh so hard...

Just like the day when someone creates the ultilmate desructive Linux virus...

I use Windows, Mac and Linux machine...but I just can't stand that chip that certain users have on their shoulder...I pray for that virus every day...

incynr8 · 11-08-2007, 04:22 PM

firmware/bios/instruction set virii are what concern me

Lrrpie-CT · 11-08-2007, 04:42 PM

Quote:

Originally Posted by incynr8

thanks, I'm stuck on V8 on the windows land here.

SAV Version 8??? Isn't that like from 2001 or so? It doesn't even do smtp scanning. Why don't you have later versions?

incynr8 · 11-08-2007, 04:45 PM

word.....it's not up to me..

Anonymous Coward · 11-09-2007, 12:39 PM

Quote:

Originally Posted by Jefe

Just like the day when someone creates the ultilmate desructive Linux virus...

You mean users that run applications as root or think the password "root" is ok?

11-08-2007, 02:56 PM	#11 (permalink)
incynr8 Purify with flame Join Date: Apr 2006 Location: On some dinky hill	V11 up might do it, V8 and down only have 'floppy' access controls. Although I understand the logic of the request, it's inefficient to have entire volumes of removables scanned on connection, rather than at infected file execution/modification/access, which Norton(or any AV) should be doing regardless of file source. a 2gbg usb stick=fast scan a 1tb eSATA drive, long scan. __________________

11-08-2007, 03:42 PM	#13 (permalink)
Jefe Active Member Join Date: Aug 2006 Location: Boise, Idaho	A good way to test and see if a virus scanner will check USB Keys is to download the EICAR test files from eicar - Home and put them on the key. Then plug the key in. We use Avast! on our student lab machines, and it detects them when the key is plugged in. __________________ -- Sayonara, not to be confused with cyanide, which is, of course, goodbye in any language. Last edited by Jefe; 11-08-2007 at 03:49 PM.

11-08-2007, 04:17 PM	#15 (permalink)
incynr8 Purify with flame Join Date: Apr 2006 Location: On some dinky hill	thanks, I'm stuck on V8 on the windows land here. I run ClamAV on my boxes, mostly to monitor files living on smb shares. __________________

11-08-2007, 04:22 PM	#17 (permalink)
incynr8 Purify with flame Join Date: Apr 2006 Location: On some dinky hill	firmware/bios/instruction set virii are what concern me __________________

11-08-2007, 04:45 PM	#19 (permalink)
incynr8 Purify with flame Join Date: Apr 2006 Location: On some dinky hill	word.....it's not up to me.. __________________