0

When a system is suspected to be infected, one of the measures often recommended for cleaning the system (without actually taking the "nuke from orbit" approach) is to scan the drive with anti-malware tools from a known-trustworthy system. The way this is normally accomplished is by removing the drive from the suspect system, and attaching it externally or internally (as a non-system drive) to the trusted system. However, an alternative option in theory would be to scan the suspect system over the network.

For example, on a Windows system, an Administrator can read the entire contents of the system drive via the built-in share \\hostname\C$. A networked drive mapping can be made from the trusted system to the suspect system's C$ share, and then antimalware programs can be run against the mapped drive.

Is a remote file system scan in this way equivalent in effectiveness to an offline scan of the drive? Or, since the suspect system's OS is still running, are there common ways that rootkits can still hide their presence from the system being used for scanning over the network which would not be possible if the suspect system was actually offline?

Obviously, "nuke from orbit" is, as they say, "the only way to be sure". However, that option is not in-scope for this question. I'm only asking if a remote scan of a file system is just as effective against rootkits as an actual offline scan of the same system.

2
  • I remember references to malware moving itself to memory and off of the drive, but then writing back to drive on shutdown. I will have to look for that.
    – schroeder
    Jul 10, 2014 at 18:07
  • Did my answer actually help you? Mar 21, 2019 at 11:23

1 Answer 1

5

No, absolutely not.
As your trusted system requests the files from the untrusted system, a root kit can hide all bad files. The even can just be locked by a process, so your trusted client cannot access the files.
If we exclude the chance of a modified bios or hdd firmware, you can run a live system from usb and export the drive using samba, nfs or sshfs.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .