786lovermk: System Admin Tools

Jun

Tips for fighting malware using rescue cd's

Posted by kalil Labels: ANTIVIRUS COLLECTIONS, Boot Cd's, tips, TRICKS

Malware is sophisticated enough to manipulate the host computer’s operating system to help it hide. That’s why rescue CDs are becoming the go-to malware detection and removal technology.

What is a rescue CD

Anti-malware rescue CDs are bootable operating systems that take control of a computer’s hardware. Since the computer’s operating system is inactive, so is any installed malware. That’s where we get the upper hand; malware can’t activate any defense to avoid being detected by the anti-malware program installed on the rescue CD.
A stumbling block
Before, I present the rescue CDs I reviewed, I want to point out some mistakes I made when using rescue CDs. One embarrassing mistake happened during a visit to a client. It was the wrong time for me to realize that certain versions of rescue CDs require a new .iso file to get the latest signature definitions.
After that oops, I made sure I used rescue-CD applications that can download and incorporate the latest signature files without needing to rebuild the CD.
That brings me to my next mistake. I typically don’t give much thought to whether the network connection is hard-wired or Wi-Fi. I assumed rescue CDs would be able to update using either. That’s not always true. In some cases, rescue-CD apps will not recognize the wireless network adapter.
Here they are
The following rescue-CD applications always get good reviews and do well in independent testing. And, they are all capable of updating their signature database via an Internet connection:
AVG Rescue CD
Base: Linux (77 MB)
Configured to create either a bootable CD or USB drive
Signature Update: Online update or downloaded signature file
Avira AntiVir Rescue System
Base: Linux (47 MB)
Signature Update: Downloaded signature file
BitDefender Rescue CD
Base: Linux (228 MB)
Signature Update: Online update or downloaded signature file
Dr.Web LiveCD
Base: Linux (65 MB)
Signature Update: Online update
F-Secure Rescue CD
Base: Linux (155 MB)
Signature Update: Online update or downloaded signature file.
Kaspersky Rescue CD
Base: Linux (103 MB)
Signature Update: Online update
Norton Recovery Tool
Base: Windows Vista PE (241 MB)
Signature Update: Online update
Best at detecting malware
Avira’s AntiVir Rescue System is consistently on top when it comes to malware detection. Virus Bulletin is a well-known test house for anti-malware, and they place AntiVir Rescue System first (registration is required).
A close second is BitDefender Rescue CD. To many system admins being second is not an issue. That’s because BitDefender Rescue CD has many attributes that make their job easier.
Most features

BitDefender Rescue CD outclasses the entire group when it comes to features. That’s in large part due to BitDefender using Knoppix, a well-thought-out Linux distro. It has many third-party apps such as ChkRootKit, Nessus Network Scanner, Partition Image, and GtkRecover. One additional convenient feature is the inclusion of the Firefox Web browser.

Create a rescue flash drive
Most rescue CD applications require converting an .iso file to make a bootable CD. If that seems confusing, this link to the Petri Web site will help explain. With netbooks becoming popular, using a rescue CD isn’t an option. One way to resolve that is to use UNetbootin. It is an application that will create a bootable flash drive from any of the above rescue-CD .iso files. I have to admit though, it’s a cumbersome process.
Thankfully, AVG Rescue CD has an alternative answer. Simply download the rescue file specifically developed for flash drives, extract the contents of the file to the flash drive, and click on makeboot.bat. That’s it. You now have an AVG Rescue Flash Drive.
OS boot sequence
One other consideration that needs to be addressed is the boot sequence of the computer being worked on. If you are using a rescue CD, the CD drive has to be moved to the top of the list. If you are using a netbook, more than likely the USB drive will already be first on the list and not a problem.
My rescue-CD wish list
Many things have to go right for rescue CDs to work. It doesn’t have to be that way. All it would take is the following:

Make it simple to create “rescue flash drives.” Why? They can be easily updated without involving access to the computer’s operating system or having to recreate the CD.
Make sure the BIOS software recognizes USB drives in their boot sequences.

Final thoughts
Rescue CDs and rescue flash drives will become more important as malware writers figure out better ways to obfuscate their code. Rootkits come to mind as they are the forerunners of deception.

Thanks : Michael Kassner, from tech repub

Tuesday, June 08, 2010 | 0 Comments

Jun

VMWare ESX Server Step by Step Installion Guide

Posted by kalil Labels: vmware

VMware ESX Server is mainframe-class virtual machine software that runs on a Linux kernel. It is a highly scalable platform that increases the efficiency of Intel-based hardware.

VMware ESX Server has some hefty minimum hardware requirements:

Two CPUs (supports up to 16)
Processors must be at least 900 MHz Pentium III Xeon
512 MB of RAM
At least one Ethernet card
SCSI, Fibre Channel, or RAID controller

These are minimums, so obviously you'll need to have more power than that. VMware recommends lots of RAM, multiple Ethernet cards (some virtual machines may run best with dedicated cards), and a separate disk controller that is dedicated to hosting the virtual machines. For more on the system requirements, see this page from the VMware Web site. VMware has also published information on supported hardware.

If you have installed a Linux distribution such as Red Hat Linux, then you'll notice that several parts of the ESX Server installation are very similar. That's because ESX Server is built on a Linux kernel, as mentioned above. You will install ESX Server just like you would an operating system because it is a stand-alone operating system. Unlike VMware Workstation and VMware GSX Server, ESX Server does not have to be installed on top of an OS.

Put the ESX Server installation CD into the server's tray and boot up the computer. You are presented with the ESX Server Welcome screen. Click Next and then keep the default installation option and choose Next again.

Memory Allocation

Your next two screens allow you to accept your license agreement and enter your serial numbers, one for VMware ESX Server and one for "Virtual SMP." The Virtual SMP serial number allows your virtual machines to take advantage of multiple processors.

After you enter your serial numbers, you will then allocate the reserved memory to your virtual machines.

Chose a disk partition strategy

Next, you will partition your ESX Server

Define disk partitions

You can use the automatic partitioning or choose to manually partition your server.

Enter the IP addressing information

Now you are ready to enter your IP addressing information and set your Time Zone.

Setup passwords and accounts

Next, set the "root" password and add any additional user accounts that you need to set up. Usually at least one user account should be added so that you don't always have to log in as root.

The final screens allow you to simply complete the installation. Remember to reboot at the end.

VMWare Management Interface

After the machine has rebooted, you can log in to the server with the IP address you specified. Simply open up Internet Explorer and type in the URL. After you log in, you are presented with the screen shown here.

Swap space configuration

The first thing you need to do is to create a swap space file. Next to where it says "Warning: No swap space is configured or none is active," click the Reconfigure link. A new window will pop up for Swap Configuration. Click the Create link and then follow the steps to set up the swap file.

Configure the virtual switch

After you are finished with the swap file, you need to create a virtual switch. Next to where it says "Warning: No virtual Ethernet switches found," click the Reconfigure link and you will be presented with the window shown here. Give the virtual adapter a name and then select the physical Ethernet card(s) to bind to it.

The core of ESX Server is now set up and ready to go. You can review and tweak your configuration by clicking on the Options tab or you can begin to install virtual machines from the Status Monitor tab.