Online Virus Scans

[oofki]

I know some of these have been posted before but I figured it would be helpful to have all these links in one place.

Scan a single file with multiple engines:

http://www.virustotal.com
http://virusscan.jotti.org

Scan your whole computer:

http://housecall.trendmicro.com/
http://www.pandasoftware.com/products/ActiveScan.htm
http://support.f-secure.com/enu/home/ols.shtml
http://www3.ca.com/securityadvisor/virusinfo/scan.aspx
http://us.mcafee.com/root/mfs/scan.asp?affid=56
http://www.bitdefender.com/scan8/ie.html
http://security.symantec.com/sscv6/home.asp?langid=ie

I am sure those are not all of them but those are some very popular ones. Enjoy :-)

[Falcon21]

These are some others that I have collected over the years:

Single file scan:
http://www.gietl.com/test-clamav/
http://old.antivir.ru/english/www_av/
http://www.kaspersky.com/remoteviruschk.html
http://sandbox.norman.no/live_4.html
http://www.unasoft.com.ua/eng/online.html

Whole system scan:
http://www.emsisoft.com/en/software/ax/
http://www.ewido.net/en/onlinescan/
http://www.windowsecurity.com/trojanscan/
http://uk.trendmicro-europe.com/consumer/housecall/housecall_launch.php <--- this works with Firefox
http://www.tenebril.com/scanner/main_scan.php

[pbrprince]

i thought there are few sites for online scan...but its many...its really useful..thx buddy

[Moira]

I still say you're better with something installed which gives you real time protection and scans automatically when your PC is idle. Most PCs these days have ample resources.

[JPnyc]

You definitely are, Moira, but I never fully trust any one scanner. All of these provide 2nd (and 3rd) opinions. I consider that crucial to really be sure.

[Moira]

I suppose that gets round the problem that you can only really have one AV program installed at once, unlike anti spyware. Two firewalls or anti virus programs would conflict and clash with each other, whereas two or three anti spyware programs can happily exist in harmony on the same PC.

I might try an online scan just to get a second opinion.

[JPnyc]

I do, frequently. And even though many AVs claim to detect rootkits, I still run rootkitRevealer weekly. You can never be TOO well protected, that is unless you go so far as to smash your modem :D

[Moira]

Well, I'm running the Panda one. I'm a touch suspicious of the results though. It's claiming to have found and cleaned 6 viruses already, which not only sounds extremely unlikely, but if it's "cleansing" a whole lot of false positves or stuff I actually want, then I'll be annoyed ..... AVG started detecting my visual studio projects as viruses at one point and moved them into the virus vault.

What I want is for it to show me the results before it takes any action. It's claimed to have found 53 spyware objects which again, is pure ridiculous! I ran Spybot and Trend Micro anti spyware just the other day - in any case I'd know if I had a machine full of spyware, which I wouldn't have in any event!

All this scan is doing so far is making me look like a clueless idiot - and worst of all it looks like taking all night. Surprise, surprise - click "more info" and there's an advert for some "disinfection software"!

Edit It's done something completely weird to my thunderbird mail too - or I'm assuming it's that. Suddenly there are duplicates of every message but though the title is genuine the content looks like it's borrowed from the spam folder ...... strange.

[JPnyc]

All I can tell you is the panda one never removed anything I ever needed. I've been using it for yrs. I find it very easy to believe it found things others missed, particularly Norton. I've seen Trendmicro catch stuff Norton missed, and I've seen Panda catch stuff trendmicro missed. That's why I never trust just one of anything

[Moira]

Well I'm sorry but I don't trust this *at all*. First, it insists on using Internet Explorer and installing an active x control, then it takes all night to do a scan AVG would do in around 40 minutes (it's still only part way through the C drive). It myseriously finds all this malware that every other program I use regularly has missed (both spyware AND viruses) and if you believe the results, I have a PC here that's barely able to boot, never mind run efficently. The cookies I deleted just yesterday have come back in their hundreds and I must be blind not to notice redirects, pop-ups and god knows what else while I surf using - yes - Firefox.

It's playing havoc with my mail client - I now have messages in unsent drafts that I sent days ago as well as the peculiar problem with duplicate messages. And at the end of the day it's trying to sell me "disinfectant software" - its main point, I would suggest.

Oh, and I have 10 rootkits :D

Edit Well, the test has ended. I can see where it's coming from, but as I thought, there's nothing there that's actually a threat. I will say this, it's extremely thorough, it's been inside zipped folders inside zipped folders etc etc. But for instance, one of the "viruses" was the EICAR test file, which it's kindly changed from text to .vir and presumably deactivated - I just replaced it with another copy from a networked machine.

Then it's found some commercial keyloggers deliberately downloaded in the past which are sitting in a folder of zipped files - harmless. It sees the SP2 patch to open more than 10 connections as a hacktool, and one or two other old similar sort of programs I'd forgotten I still had. There are some files found in Thunderbird which are no doubt attachments to spam email which has gone straight into junk folder for deletion in a few days and if I'd tried to open the frequently infected attachments I'd have been warned by AVG (usually it catches them anyway, but I'd never in a million years click something like that).

I have Passware on my PC as it's handy if I forget an Office password etc - it saw that as a threat. Also, unlike most spyware scans which only scan the current user's cookies etc, this has gone over every user and there are some cookies that could probably do with deleting from other profiles - I'll make a point of doing scans logged on as my kids I think!

In short, it was very thorough, showed me a few things I'd forgotten were even on the PC that I could get rid of because I didn't need them any longer, some tracking software from other users, but to say there were 6 viruses, 10 rootkits and 53 objects of spyware plus a few suspicious files was really a bit OTT. There's nothing sinister residing here!

[JPnyc]

That's why it takes so long. It scans everything, even compressed files. You'll also note the file count is MUCH higher than anyt other scan you use

[Moira]

It certainly was! I couldn't believe my PC even had that many files on it - just shows what rubbish you collect when space isn't at a premium. There's stuff on here that was ready for the recycle bin 3 years ago, but because it's stored on large data partitions, it's less effort to keep it than sort through it.

[oofki]

Moria and Jpsync are right it is a good practice to have an active anti-virus engine running on your computer at all times. But I posted the links for people whos a/v doesnt pick up on something or if you have a suspicious file you would like to cross check.

[Moira]

That's right oofki - it's always said to be good practice to have two or three anti spyware programs on your PC as one will find things another will miss. That's somewhat down to whether a particular file is deemed to be spyware or not - a virus ought to be more clear cut - but the point is you can't do the same thing with anti virus software, two programs running at the same time would likely create problems. So it gives a chance for different software to analyse your system, and certainly in the case of the Panda one I tried, is incredibly thorough, more so than the daily scans AVG does.

[dalek]

More then one AV running does cause problems if they are scanning in "real time", I know that Norton and McAfee pretty much don't get along (must be propriety), and we all know how much Norton likes to control the whole OS.

It's okay to have your workhorse AV as the one running in real time and to have an option to scan manually with another version, I have seen far too many HJT logs where people have Norton and AVG or even AVG and Avast present and both running at the same time, and the op is complaining of a slooooowwww PC, well guess what....they are both fighting for the limited (in most cases) amounts of resources available.

Apply the KISS principle when fortifying your PC for safe surfing...;)

[JPnyc]

I find having one loaded and using online scans for the 2nd and 3rd opinions to be sufficient. I also change up the online scans I use for those other opinions. If you just use the same ones all the time, any malware it misses it will continue to miss.

[dalek]

I find having one loaded and using online scans for the 2nd and 3rd opinions to be sufficient. I also change up the online scans I use for those other opinions. If you just use the same ones all the time, any malware it misses it will continue to miss.
Agreed, but if a user is doing this constantly you have to question their surfing and or opening attachments habits...bottom line is edumacation.

But the battleground is changing as we talk..

Security analysts are already writing eulogies (http://securitywatch.eweek.com/virus_and_spyware/antivirus_is_dead_dead_dead.html) for stand-alone, signature-based anti-virus, arguing that the industry will be forced to roll out converged security clients, offering multiple capabilities including anti-spyware, personal firewall, end-point policy enforcement and intrusion prevention as the foundation.
"We're already there," Kaspersky declared, when confronted with the dire predictions. "There are no stand-alone anti-virus products anymore. It's now anti-everything. You have to do things like behavior blocking and heuristic detections and add anti-spam, anti-spyware and anti-rootkit capabilities or your software won't be any good."
Add data leak prevention and patch and configuration management into a single console and this is your new enterprise anti-virus product.
http://www.eweek.com/article2/0,1895,2074772,00.asp?kc=EWEWEMNL121806EP24A
So an AV that only scans for virus is not going to be good enough, the sector is moving to bring it all under the hood, perfect example now is Ewido being absorbed by AVG, my Trend Micro Internet Suite 2006 has had these functions for over a year now, and is probably why a lot of corporations are switching to them, an all in one troubleshooting centre.

[Moira]

That's very true - not that I can imagine Panda missing anything, it dug up folders I'd long forgotten were even on the system.

The problem is that the people who take the attitude we've advised here are not the kind of people to badly suffer from viruses anyway, because people who take security this seriously probably have enough common sense to avoid picking up more than occasional malware, which any one of the security measures on their PC would instantly pick up.

I think the reason viruses are still so widespread is down to the people who have outdated software on their systems, don't patch Windows and whose online behaviour predisposes them to picking up malware in the first place.

[JPnyc]

Agreed, but if a user is doing this constantly you have to question their surfing and or opening attachments habits...bottom line is edumacation.

That's true. I ran a pc with NO av and NO fw for 8 yrs, on win98! It can be done if you're careful and know what you're doing. I think I had only 4 things running at startup. I couldn't afford to upgrade back then, and had to keep the pc able to meet the ever growing demands of newer software, so I kept removing things that were running at startup to free up ram and processing power. Of course that means no AV and no FW because we know how much they suck up.

[JPnyc]

That's very true - not that I can imagine Panda missing anything, it dug up folders I'd long forgotten were even on the system.

The problem is that the people who take the attitude we've advised here are not the kind of people to badly suffer from viruses anyway, because people who take security this seriously probably have enough common sense to avoid picking up more than occasional malware, which any one of the security measures on their PC would instantly pick up.

I think the reason viruses are still so widespread is down to the people who have outdated software on their systems, don't patch Windows and whose online behaviour predisposes them to picking up malware in the first place.
And that's also completely true. It's not the pc savvy people that are most often infected. It's the novice. I can configure IE so that it's just about as secure as any of the other big 3 or 4 browsers out there (even though Opera still maintains an obscurity advantage), but for a novice I always recommend Firefox, even though I don't use it and don't like it. A novice user should not be using IE.

[Moira]

A novice user should not be using IE.

Which they all are of course. How many workplaces for a start, use alternatives to Internet Explorer and Microsoft Office? People whose only experience of the internet is at work mostly don't even know they have options.

Not that the majority of workplaces are a risk when it comes to infecting machines, if only because users don't normally have enough privileges and systems probably clean boot or are otherwise protected by whoever administers them.

I think in the days of Win98 it was perfectly possible to get by without firewalls and anti virus - nowadays I'm not so sure, unless you're going to take all the fun out of the internet. We may have watered down the effect of dialers with always-on broadband, but the fact that it is always on brings its own problems.

[JPnyc]

Well on an intranet, IE poses no real threat, obviously, and the sysadmin should be configuring the user's browser so that it's secure.

[the tree]

Well on an intranet, IE poses no real threat, obviously, and the sysadmin should be configuring the user's browser so that it's secure.How often do you come across an Intranet that is actually closed to the outside world? I'd say that practically every situation will sometimes need a connection to the Internet, even if it's not strictly needed, I'll bet it's usually there.

[JPnyc]

That's why I added that the sysadmin should be configuring their IE and their station in general so that it's secure. If they had no net access that wouldn't be necessary. If someone is engaging in mischief on an intranet, they'd be found out and binned pretty quickly, I would think

[Moira]

the tree, I must be an exception to the general rule then, because I don't have internet access at work. It's not an uncommon situation either - I have a friend who works for Sky TV technical help and they don't have net access either.

If it's not needed why enable it? I'd like it obviously ... but I have to admit that from an admin point of view it's a better setup than unrestricted internet access for people within a secure campaign who don't need it for their jobs.

[JPnyc]

Might be a regional thing, Moira. Here in the US I've never had a tech job wherein I didn't have web access.

[nihil]

I guess it all depends on what you do Joe?

If you are working for a major supplier or a helpdesk supporting specific products, you probably don't have internet access.

When you work in systems development or more general support you would normally be expected to have internet access so you can access vendor sites, FAQs, help forums and so on.

[Moira]

I think "tech job" is a bit of a misnomer for some of the so called "help" available to customers. I've always been a bit disappointed when I have had these sort of jobs, to find that not much importance is placed on the technical side - it's all about customer service and getting rid of the call queue (to hell with solving the customer's problem), so that service levels don't drop to an unacceptable level in the stats that go back to the client (the real customer). An advisor's skill at dealing with awkward people day in day out is much more valued than their ability to provide them with useful information.

At least in the outsourcing world this is the scenario. To that end, internet access and PCs with accessible USB ports and similar are just a security headache and often disabled.

[JPnyc]

Interesting, I've long suspected that of call centers in the US. They do seem more interested in getting off the phone than in actually addressing the issue. Most guilty are the cable companies, who just want to schedule a technician to come out, even though I'm 100% the issue isn't on the premises.

[Moira]

What you have to realise is that YOU are not the customer, and your needs will be given less priority than those of the client who has given the contact for technical help/customer services to the outsourcing company.

[JPnyc]

Well all the cable companies that I know of really abuse the monopoly they have in most areas. In the UK, and also where my parents live, they actually have the audacity to CHARGE for a service call!! That boggles the mind. Hey bud, it's YOUR service that's malfunctioning, not mine, and I'm already PAYING you for a service you're not delivering. How the heck are you due MORE MONEY?

If my cable co. pulled that once, I'd have direct tv and wireless the next day

[Moira]

There has to be something of a balance because if customers started leaving in their droves, then the company concerned would do something about it, but one of the reasons call centres get a bad name is because most people don't realise there's often a conflict of interest.

[JPnyc]

That's the problem, here in the states at least; these companies have a monopoly on their given areas. Your only other options for broadband are ADSL, or wireless satellite, neither of which is as fast or as reliable.

[muert0]

We are starting to get more options they have dsl around here that runs just as fast or faster than cable and it's a dedicated line so you don't hae to share your bandwidth.

[Moira]

You aren't contended at all? Surely that can't last as more people get broadband?

[JPnyc]

Well it's a common claim that with DSL the number of users don't affect your speed, but in real world terms, it does. The only DSL where I live is the 3mb variety, which still is slower than our cable

[nihil]

Hi folks,

Moira is spot on, the issue is contention. Where you are sharing a resource then the more people using it, the less everyone gets.

The ISP/Telcos work on the principle that they can sell the same resources to multiple parties, and this won't be a problem because they don't all use them at the same time........................

muert0 has it right, you can get dedicated (single customer) connections, but they are rather expensive, at least over here.............. that is what businesses generally have, or probably a contention of 4:1 for smaller outfits.

[muert0]

Well it's a common claim that with DSL the number of users don't affect your speed, but in real world terms, it does. The only DSL where I live is the 3mb variety, which still is slower than our cable
Eatel has a 10mb down/3mb up for $60 here and if you have a phone it's cheaper. I just don't intend on getting a phone so I didn't ask for the price with.

[JPnyc]

Well our DSL here is 3mb down, for 39 bucks and the cable is 7mb down for 42 bucks. Not a tough choice there. The cable is also upgrading to fiber optic which should double the speed this yr.

[muert0]

That's why out DSL is going down. All the phone companies started dropping fiber.

[nihil]

I wonder what speed DSL you guys actually get, and what the contention ratios are?

Over here you get 50:1, 20:1 and 4:1 as typical values unless you have the dedicated option.

[JPnyc]

Well the speed I gave is the actual speeds I receive in online tests. I have no idea what speed they actually advertise.

[Moira]

Well, over here unless you're living in the middle of London and lucky enough to take advantage of LLU (looped line unbundling), you're going to be limited to a theoretical 8Mb on BT's ancient lines, or 10Mb if you can get cable (and not everyone can by a long way).

Emphasis on the word "theoretical". In practice speeds - real speeds - in the UK are around half that. That's an average, depending on how close you are to the exchange and a whole heap of other factors, but many people can't get much above 2Mbps which was the fastest speed offered prior to the maxdsl rollout.

I don't know what current contention rates are - they'll vary anyway depending on how many people in your area have broadband - but if I remember rightly, contention was originally to be set at a maximum of 50:1, but early on people realised that no way would it be practical to have it at greater than around 20:1.

[JPnyc]

Well the same is true here, Moira. But I live in midtown manhattan which is pretty much the center of all things technical, here. However my parents out on Long Island, about 60 miles away, get about 10 to 14mb down.

[Moira]

Still better than the UK ... and yes, this is downstream I'm talking about. The max upstream you'll get in a normal ADSL connection is 448 (Kbit/sec).

[muert0]

I get 6-7k down and 750 up on my line. supposed to be 5mb/500k.

[Moira]

I don't understand that .... the upstream rate here is set at 448 and it isn't possible to "accidentally" get a higher rate.

[JPnyc]

Sometimes they advertise a slower speed than you might get, simply to avoid complaints. Cable companies do that here. I think my cable co. says something like 2mb down, and I get 5 to 7.

[Moira]

LOL, what a rip-off country I live in then! Here in the UK they do the complete opposite, ie advertise maxdsl with the brilliant speed of 8 Mbs and then actually deliver about half that to most customers :)

[JPnyc]

They do that here too (some still do) but they found they were getting too many complaints. Now, what some do is advertise the max speed you'll get, but in fine print it says *actual speeds may vary.

But the UK gets ripped off where goods are concerned. You pay the same numerical value for a product as we do here, but 1 pound-sterling = $1.70, so brits are paying 70 cents more on the dollar for goods.

My pal from Lancashire came 3500 miles to visit me, and ended up buying a pair of clarks shoes here (made in england, the sales clerk was hysterical when I told him). They were something like $25, in the UK they'd have been 25 quid.

[nihil]

Yes Joe,

I can see what Moira is saying. Our lot advertise the maximum values and it is really up to the user to make further enquiries such as the contention ratio.

I have been offered 8Mbps but there is a tool on their website that suggested that I should not expect more than 6Mbps, where I am located.

[Moira]

Yes, that's quite common, people bringing things like trainers back from the States to the UK. It's just so much cheaper to buy consumer goods there!