mm3 Posted March 10, 2016 Posted March 10, 2016 is it possible to scan an offline Linux .VHDX VM? we have an infected Linux server so I have turned it off. is there a way to scan this from the hyper v server?
3s-gtech Posted March 10, 2016 Posted March 10, 2016 I don't think so (at least with no product I've seen, but there are some amazing tools around) - you'd need to mount a bootable virus scanner from within the VM I suspect, and load that up.
Arthur Posted March 10, 2016 Posted March 10, 2016 Boot the Linux VM from an ISO of one of the various offline anti-virus scanners. www.raymond.cc/blog/13-antivirus-rescue-cds-software-compared-in-search-for-the-best-rescue-disk/
Norphy Posted March 10, 2016 Posted March 10, 2016 You can mount VHD(X) files as a drive in newer versions of Windows but I suspect that to scan for viruses, Windows would need to be able to access the file system. I doubt that the Linux installation would be using FAT32 and ordinarily, Windows can't read EXT3/4 volumes so I think that the Live CD virus scanner is the best option. Assuming that they can read Linux file systems anyway.
Arthur Posted March 10, 2016 Posted March 10, 2016 Assuming that they can read Linux file systems anyway. Most of those scanners are Linux-based so they should be able to. The Kaspersky and Avira ISOs definitely are.
mm3 Posted March 11, 2016 Author Posted March 11, 2016 Most of those scanners are Linux-based so they should be able to. The Kaspersky and Avira ISOs definitely are. I have tried many from the list. none of them see the volume that is infected.
Arthur Posted March 11, 2016 Posted March 11, 2016 I have tried many from the list. none of them see the volume that is infected. Which filesystem does the Linux VHDX have?
Dodgex1 Posted March 11, 2016 Posted March 11, 2016 Is your nix volume encrypted? Sophos Bootable AV (SBAV) is based on SLAX so that will read it if it's not encrypted but you'll have to fire it up and 'boot' the CD. Move the VM onto a standalone if you're bothered about firing it up. How do you know it's infected? are you already running AV on it?
Geoff Posted March 11, 2016 Posted March 11, 2016 How did the Linux VM get infected (I assume it's a windows virus hiding in a file share or mail spool on the Linux VM)?
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now