Rescue Disc

Today I took some time to investigate the Rescue Disc function. Some thoughts:

The effort to build the disc is tremendous:
1. Download the Windows AIK with 1.2 GB (even on Standard-DSL a monster of bytes.)
2. Install .NET Framework 2.0
3. Install MSMXL 6
4. Install AIK

This all for building a Windows PE with SYSRescue.

I would prefer as an option:

A plugin for NOD32 with Bart PE.

All that is necessary is the PE Builder, just 3.3 MB (!) small and working without installation.

Furthermore I don't think, that a real-time protection (as in SysRescue) is really needed. (The PE drive is not writable.) What I think would be necessary is the possibility to scan an inactive system, so that even rootkits are not able to protect themselves.

Therefor the plugin should do the following:
Make NOD32 able to be started from Bart PE (make all appropriate settings in the registry and give the information, which files have to be copied to the PE Builder plugin folder)
Give the option to download the last definitions from inside Bart PE and use them from the Ramdisk.

Alternatively: If application and definitions have to get necessarily on the same drive and if they would be to large for most Ramdisks give an option to place it on an USB stick, so that the pc can get started with the Bart CD and NOD gets started from the stick.

 

I second that!
BartPE is awesome, and most other AV's use it (KAV etc, DRWEB etc).

I don't see a need of polluting my system with a 1.2Gb install and maybe something that might run in real-time gobbling up resources.
NOD32 with AH on is resource heavy enough as is.

 

I agree as well, way too much hastle.

The sad thing is that there has been a working plugin for NOD32 available on the 911CD forum for at least a year now (versions 2 & 3) and what I don't understand is why ESET didn't take probably just 5% of what they invested into this Sysrescue joke and took a closer look into the plugin and made it fully functional. How do you explain that move to your shareholders ESET? This was suggested to them a while back, but while everyone else is going Linux or Bart's for their rescue CD solutions, ESET chooses Microsoft PE where you have to install 1.4GB unnecessary software

I must say I chose ESET for it's small size, small footprint and simplicity. Why they decided to ignore perfecting a working solution on the 911CD forum and create a bloated 200+MB monstrosity of a rescue CD is beyond me.

I personally think resident AV protection is preferable in a Bart's PE environment, because once you diagnose the problem on the host PC you might need to download something from the internet, and that just opens the door to the possibility of more nasties.

My 5 cents worth.

 

Bootable disk with simply coping the ESET command line scanner + definitions is quite simple and fast to scan the inactive Windows system for threats (including hidden files)

 

Yep, but there is one more point: A CD / DVD (Windows PE or Bart PE doesn't matter) is a thing you do not burn daily together with your files backup. That mean, the definitions on the CD will be outdated very soon. The CD-version must have the possibility to update, otherwise it is rather useless. Following Murphy's Law you will have the need for a cd with actual definitions just in the situation, when you are not ready to burn one.

Coming back to Bart PE. Except the obvious maladjustment between effort and result using the actual way I come to the question, where is such a cd needed?

As already said, a on-access scanner from a stand-alone Windows PE with no app except NOD installed does not make really much sense. (To be honest: I did not find a single one.) An on-demand scanner for scanning the extern system can be useful; but IMHO this usefulness is very limited. Many security experts tell, that in case a system got compromised, the only reliable way is a new installation or restoring an image (in case there is one). Especially if the malware has itself placed such deeply into the system, that only scanning from another system will find them, I would never rely on such a system - even if NOD and an army of other tools say "clean". So, the usefulness of such a rescue disk is very limited. Really far beyond the effort to install 1.5 GB (AIK + .NET Framework + MSXML) of software, which the user may not want.

Some maths: Here are some people who argue with their limited bandwidth, that they still are on a patch level of their OS that is far more than 6 years old!!! And even the actual SP3 for XP is "only" (in comparison to this 1.5 GB Dinosaurus) a few 100 MB big. This means, all people who do not have a broadband connection will be definitely excluded from the option to build such a rescue disk. Calculate yourself: Even on a standard DSL-connection with 6000 MB/s it takes more than 33 minutes for downloading, on an ISDN-connection with 64 kb/s this are 125 hours(!) or 5 days (in theory). This does not appear, as if a greater part of the NOD customers will have any benefit from this new feature.

But having the NOD-scanner besides other rescue tools on a cd in a way, where the definitions can get updated from within the PE system makes much sense. Bart PE provides such a solution, many of the needed plugins are already available and it should be not a great effort (better said: a very smal effort) for the ESET technicians to build a INF-file with the needed registry-keys and values.

The more I bother with the actual solution for a rescue disk in V4 the more I come to the conclusion, that this is (not from technical, but from practical aspects) not usable.

 

I'm going to have to disagree with everyone here who says BartPE should be the way to go, and to drop Windows AIK; at least from a business standpoint. Showing off the current SysRescue CD is what got my manager sold on the idea to switch from McAfee to ESET.

We had 2 computers that were infected with that damned Antivirus 2009/vundo trojan while using the McAfee Enterprise suite. Typically, this is an image, rebuild, and restore suitation (a lot of hours lost on downtime for the user, and time for me for rebuilding, patching, and restoring documents for myself.) Instead, I used the SysRescue. Cleaned both laptops in 45minutes of the crap. Both users were back in business in no time.

SysRescue completely worked for me, and I'll use it time and time again. The beauty about how it is setup, is that I can just push the .iso files to our satilite offices, is that anyone can use it with minimum guidance from me. And since my satilite offices (world wide) do not have an IT staff member on location, the easier it is, the better!

I hope ESET doesn't change a thing, as I am the proof of concept that it worked!

 

@Geosoft

From a business standpoint you may be right, however, there are a number of IT professionals who customise their own CD's and can push these ISO's just the same (with many more tools included, even other AV programs).

As it is going to be impossible to get everyone to agree to the best solution, why not both?

ESET are developing the Windows AIK based rescue solution, while the BartPE plugin has been available for a while. Why don't ESET give the plugin a look, make any necessary changes and give it their stamp of approval?

It is just a question of getting all of the registry entries needed and start the services in the right order. Version 684 currently starts in BartPE, all services are enabled, however the update doesn't work with the last two versions (at least with me).

How about it ESET?

 

Hello,

Please keep in mind that there are technical as well as non-technical issues surrounding the creation of bootable media.

Regards,

Aryeh Goretsky

 

You said it yourself: Typically this is an image-restoring situation and as I did say already, cleaning is a solution, that is absolutely not reliable. As it seams, that your company uses a beta version for productive machines, there seams to be more untypical here.

Nevertheless, you did nothing, what you could not have done using a Bart PE CD. But it is fact, that you would not been able to do it with the actual solution, if you would not have been on a broadband connection to the Internet. So this indeed a proof for nothing.

I follow lepicane, that both solutions could be done.

 

Hi Aryeh,

what does this mean?

You posted a sentence, where everybody can only say yes. But If I would write a message withe the only content "Can you read this?" also the only possible answer would be "Yes".

So, what is your real meaning of your contribution?

Some speculation: Technically you agree with my Bart-solution, but there are other (legal?) aspects against it. It would be a pity, but I am not a lawyer and international rights is even more complicated.

On the other hand: No one asks ESET to give or show a way for making a bootable CD. Here it is only about the needed registry entries to get NOD running as on-demand scanner and being able to update the definitions on a PE system. So leave from your sentence all beginning with the word "surrounding", than you will come to another result.

One idea more: What about a Bart-plugin, that gets published [1] here as a contribution for giving NOD an advantage over most competitors? In this case it would not be in the product itself. The legal rights for those reg keys / values can no-one have than ESET themselves.

[1] More or less nothing more than an INF-file and a XML-file for the menu, probably a CMD-file for some tasks at startup and maybe a help-file (but not technically needed).


EDIT: As I said, I am not a lawyer, but those facts should get known (if they are not already): I wonder, if you might fear, that MS might have "headaches" by indirectly using a product from Bart Lagerweij. But note, that not only the PE builder is a product that is now for several years on the web without MS doing something against it. Interestingly there is an official site, where MS shows how to slipstream an installation CD. For getting this slipstream bootable, what does Microsoft tell to use: Not an own tool, but exclusively BBIE.EXE from the identical Bart Lagerweij! Read yourself: http://support.microsoft.com/?scid=kb;en-us;894950&x=5&y=12. This appears really mysterious, as the boot sector for the Windows CDs must have been written by MS themselves and I cannot imagine that they do not have an own tool for extracting the boot image. Nevertheless, it is a fact, that there exists a link to Bart's web site from an official and own MS support site.

 

Hi Cosmo,

Not to get into any arguments on which PE would work best for everyone, but I was trying to say not to discount Windows AIK.

Plus I think there are a few reasons why ESET is going on the Windows AIK path for its PE, over Bart.

1) There will be "support." Air quotes around the support as you can't phone someone for BartPE setup, it is only community driven.
2) Windows AIK supports 32bit/64bit Vista, 2008 and the future Windows 7.
3) Why not work with a company doing the PE who knows the OS best?

 

Hi Geosoft,

Let's have a look.

But community driven support for Bart PE works very well. BTW, the phone support is really expensive. And I mean: it hurts. Additional (you might not know about this): There is also an important community driven support for MS products in Newsgroups, and it works very well.

AIK is mainly meant to support system builders and IT professionals for jobs, which go far beyond building a PE disk.
Taken from http://www.microsoft.com/Downloads/...FamilyID=94bb6e34-d890-4932-81a5-5b50c657de08

For a PE disk that, what you said is without any interest. As long as you can read / write the filesystem of the inspected PC all the other points you named are only interesting for those people, who have been named by MS.

Does this mean, that you do only use applications from MS, as long as they have any offer? So, why do you use NOD or McAffee, if there is Defender? Sorry, I can not share this point of view.

Technically it is wrong. Bart's PE Builder takes Windows' original sources (and needs to have the Windows installation CD) for a building the PE. So, the source of Bart PE is Windows. And you should have read my last post where I showed, that even MS uses or recommends as the only solution for getting the boot image for a new CD a tool by the same author, who wrote the PE builder. If this is not a recommendation for Bart's experience and knowledge than I don't know where such a recommendation shall come from as from those "who knows the OS best".

Not to forget: You tried to hide (or forgot?) the most important point that shows, that the AIK solution will not work for all of the ESET customers, who want to have such a rescue disk: The 1.5 GB download traffic. How many NOD-users does ESET have? Some millions? Now multiply this number with the 1.5 GB and you get a traffic of some thousands TB(!!!), for nothing else than building such a disk. If somebody wants an example for ineffectiveness, this is a perfect one. OR is rescue disk a feature, which is only for a minority of the NOD customers? I bet, that all - even those, who are not able to download such a monster - have to pay the same price. That is not fair. With the actual solution only a small fraction of the customers of NOD will be able to build the disk.

Modifying the words of Aryeh Goretsky a little bit:
There are technical as well as non-technical limitations for building the AIK-based rescue disk.
The limitations appear to be multiplied as great as the possibilities.

 

I think arguing point by point is very counter productive, unless you can identify a number of quick wins that can overthrow the other. Neither PE has this for the time being.

The items I have listed is from a standpoint of a fellow Software Company, as we too create our own software, that would understand the move ESET has made.

Whatever choice that ESET provides to make a rescue disk is fine by me.

 

A strange position. You give some arguments and if you get the answer, why those arguments are wrong you say, this way of point by point arguing is wrong.

Okay, if you prefer a more general answer: It seems, that you do not know anything about what you wrote.

The situation is even worse, if one takes the time to investigate into the details:

About the argument of technical support for AIK: (The No. 1 argument in your previous post): What you wrote is untrue. Taking a look into the help file that comes with AIK, there is an own chapter about support. This chapter says: "Apply to the Technology Adoption Program (TAP)-employee in your company for getting technical support." (Note: this is a word-by-word translation, as I have a German AIK. Nevertheless, this is the whole content of that chapter.) So far to the theme "support". Perhaps you write to Microsoft, that you find it counter productive destroying your dreams.

Another problem is - and this will limit the people, who can use the present rescue disc solution even more as already described -, that AIK and Windows PE are based on Vista-systems. That means, that you cannot build the disk on older machines with low amount of RAM and you cannot even use the disk on machines with low amount of RAM. A Bart PE runs on every machine with 128 kB, with some tweaking even if there is less RAM. So in the end, not only people with small bandwidth are excluded from usage, but also people with (supposedly) older machines. Their machines cannot be examined even with the help of other people, building the disk - all that is no problem with Bart PE.

 

Hello,

Perhaps ESET Knowledgebase Article SOLN557, "Integrating the ESET On-Demand Scanner (v2.7) with UBCD and BartPE" would be of interest? It is for NOD32 v2.70 and not ESET NOD32 Antivirus v3 (or v4), but it at does provide information for that version of the software.

Regards,

Aryeh Goretsky

 

WinPE based on AIK.
Building the CD:
You can build the disc on older machines with low amount of RAM, building CD itself via SysRescue wizard has nothing to do with the fact that WinPE is based on Vista system. Building performs only copying files, mounting and modifying registry hives, injecting drivers and so on. These operations don't require big amount of memory. On older machines it will take longer time to build the CD, that's all. Right? And you can use the Wizard on WinXP too.

Using the CD:
Then, for booting from CD, there are 2 modes: RAM disk (whole image is first read into RAM) and CD-ROM. Depends if you want to boot from CD on machine with more or less than 512MB RAM. You wrote "A Bart PE runs on every machine with 128 kB" - hard to believe, only ESS/EAV itself needs more RAM, not talking about OS. Probably you meant 128 MB, now how many people today do have ONLY 128MB RAM? It is too few memory also for WinXP, not to mention Vista. And with 256MB of RAM Sysrescue CD works fine, I did try it right now, you only need to select "less than 512MB" in advanced settings in Wizard when creating it.

One more remark.
Fact that WinPE from AIK uses Vista also means wider support for HW by default than WinXP supports. Mainly NIC drivers are important since you would like to update virus signatures in ESS/EAV from web, I hope. And also drivers for SCSI controllers can be important to have access to HDDs on SCSI controllers. If driver for your NIC or SCSI controller is still missing in WinPE, SysRescue wizard allows to inject external drivers into iso image while creating it. Is it also possible with BartPE builder?

 

@trencan

1.) Yes, the disc can be build on machines with low amount of RAM. I forgot that by building the disk not really AIK, but only the PE builder as a part of it gets used. So far my fault.

On the other hand this again shows again this waste of resources. The user needs a fraction of the 1.5 GB, but this amount - and this may never be forgot - will hamper a great part of the NOD-users to use this feature at all.

2.) Yes, an obvious typo from me; of course it must read 128 MB. BTW, i beg that many users do not see the option to build the cd for a less than 512 MB-pc (it is not very obvious) and anyway, if you have build the cd with 512+MB setting (e.g. for your own machine) and go with this disk to a friend for helping him and you find, that his machine has less RAM, than you can forget about the cd. This will never happen with a Bart disk.

3.) The PE builder for Bart PE has a subdirectory, where you simply place the drivers for NIC and SCSI. The PE builder makes the rest. - This means also, that those drivers are available for all programs in Bart PE, which have the need. So you can make a remote desktop connection, a VNC-connection or whatever you need to rescue a machine or at least the data there on another machine. Further more: With the same Bart disk I can save the data files by burning to disk or copying on an usb drive (if no network connection is available), I have tools for restoring data, which is deleted and not even on the trash bin, but mostly still to be found on the hard disk (doing this from inside a system may already destroy the data during booting), I have a disk editor if needed and so on. Bringing this all on the Windows PE system will be a very time-consuming job.

 

Hi Aryeh, thank you for that info and link.

I didn't know that and made some tests with that.

I have no problem with the fact, that this is on V2.7. But there is a big problem there, which (at least in this moment) seems to make this not really usable: The impossibility to update the signatures on a Bart system in conjunction with the fact, that the signature files are incompatible with V3+.

Taking the situation here: I have on my physical machines NOD V3 (multiple license). For testing the plugin with a fresh download of NOD V2.7 I created a virtual machine (without Internet-access). This fresh download (taken from http://www.eset.de/download/vollversionen/#eav in case you might want to know) has definition from the year 2007, so really unusable. What shall I do with such an oldster? But even if I would make an Internet connection for getting the actual definitions, after a short period they are old again.

So this plugin based on V2.7 (which works beautifully otherwise) is rather useless, if the definitions cannot be updated from within Bart PE or at least taken from V3+ NOD. Obviously you cannot install 2.7 besides V3+ only for getting the updates. (Furthermore this may get a licensing problem.)

I tried to use the definition files from V3 (it seem to be the em00x_32.dat files) and renamed them; as I expected this did not work, NOD 2.7 told me there is something wrong with the nod32.000 file.

As said already in the last days, the possibility to update the definitions is crucial. (See post #5 first paragraph). With that I could even live with the command line version of V3 (although the GUI-version of the plugin gives additional advantages).


---------------------


Just something different: For comparing some things I started the Win PE build with V4 in another virtual machine, this time with Internet Access. NOD updated fine and had as result the same signature file number as V3 on the physical machine. Nevertheless I forced it to update again (later in final version the user will most probably not have the possibility to compare the signature version on different machines). Of course there is no further update possible. But I notice, that NOD gives me on the update page a (wrong) warning, that the "signature update failed", clicking on "Troubleshoot update issue" does nothing. I think, that simply the error message is wrong.


---------------------


The site with the Eset Knowledge Base is interesting not only because the plugin, but also, because there is a link to the PE Builder site from Bart Lagerweij. So when I wrote in post #10 yesterday about possibly Eset having headaches using Bart's PE builder, this does not seem to be the case. But in this case I do not understand at all, what you wanted to say in post #8.

After having done the described tests I repeat my request: Either give us a plugin for Bart's with the possibility to upgrade the definitions or make V4 usable on a Bart PE system. BTW: the plugin for V2.7 shows again, how simple and quickly a working rescue disk can be made.

 

1.) AIK is completely legal and with new versions of windows, there can be released new versions of AIK based on these newer systems. Once you need to rescue systems on HDD with latest version of windows installed and you boot up rescue CD based on some old one, you will not have support available in this old system for all new features.

2.) I see no problem here. If you know that there will be intention to use your SysRescue CD in machines with less than 512MB RAM, you can still create iso image with option "less than 512MB RAM" and this image you can then use everywhere, on all machines with at least 256MB RAM. Such a CD will work on machine with 4GB RAM very well too. So you have universal CD.

Only difference between modes RAM disk and CD-ROM is that RAM disk which requires at least 512MB RAM first loads iso image into RAM, unpacks it and runs. So as soon as image is loaded, you can eject CD for example and what's more important all your work inside WinPE will be faster, since whole image is already loaded in memory. Other mode CD-ROM requires less memory, but then when working in WinPE, system must still access CD drive, so response is slower.

3.) Release version of SysRescue should allow to copy also user defined directory into iso image, where user can put applications which he wants to have available after booting the CD.

 

About legal: See my last post addressed to Aryeh. And see my messages about links from official MS support sites to Bart's site.

About support: Which support? (I wrote about that already, too.) And: I need no "support" for a new AIK, if I
at first do only need the build-in PE builder
and at second do use Barts PE builder with community driven support.

If I have e.g. a 2 GB machine, than my intention is clearly to have a rescue disk for this machine. I do not see, why my intention should suddenly tell me to make a disk for a weaker pc. But if than there is the situation as described by me, than I am stuck. Fact is, this does not happen with Bart.

You say "Only difference", but this is the point. If it would not matter and if MS or ESET would not know about this issue, there would not be the option to set this. So in fact, this is the point. If I make the disk for myself (see above), than I would not change the default setting (for 512+ MB), why should I? The fact is, that this disk is useless on machines with less RAM. The option, you took yourself as argumentation, shows the problem clearly. No flexibility!

Other example: You have made a -512 MB disk for being more "universal". Now you come to a machine, which has the 512 MB for the + Disk, but has only one optical drive, which you need for running PE. You have to save some files and because there is no possibility to do that via network you want to burn them to disk. But with your "universal" rescue disk you cannot take the disk out. What now? Again, you are stuck. (Besides that there would arise the question, how to get the burning app working on that disk, simply copying (see below) is not enough.)

You see, the current solution brings - besides a 1.5 GB download monster- question over question. BTW: Why do you repeatedly ignore the monster download problem?

Release Version should do much more. But if Eset puts a public beta here and the users are asked to check it and write about it - what else is a public beta good for? - than I cannot test, what there should be, I can only test , what is. In addition I give my ideas, what should be. And after having made the tests (doing this monster download, doing the needed, but not wanted installations) and collecting my experience I come to the conclusion: This way will not work except for a tiny minority of NOD customers. Did anybody write, which experience he made with this SysRescue, which could not have be done with a Bart PE? No, nobody here spoke of his experience with SysRescue in comparison with Bart PE experience; in fact I have the feeling, that hardly anybody has created the SysRescue disk at all and they write about their theoretics.

And I say clearly with many arguments: Make a plugin for Bart PE as an option. (I wrote already in the past, that there is nothing to say against leaving the momentary Win PE solution. For those who prefer it.)

The other point is, that it is not enough, to copy (as you wrote) some directories with other programs to a directory, that gets included into the iso image. You need those tools integrated. With Bart's PE Builder you have the necessary tool. For the Win PE-based Eset Disk this would have to get made in a comfortable way, and I am sure, that this is far beyond the scope of Eset.

 

And how can be BartPE built by someone, who bought new PC with Vista installed, means doesn't have necessary XP install CD. As I have info, BartPE Builder requires strictly only XP installation files (http://www.nu2.nu/pebuilder/). It can not work with Vista CD. Seems BartPE is also not universal solution. Vista's users are then out. Please correct me if I am wrong.

 

Regarding Vista: Yes, this is an valid argument. (I forgot this aspect, obviously, because I prefer XP.)

Nevertheless, I wonder, why you quoted my whole post. Quoting without the smallest con is commonly understand as tacit approval. If have nothing against that. But therefor it would not be necessary to quote a whole post.

But reading instead would have shown you, that I wrote in the second last paragraph, that both solutions can stay side by side. And you can also read there, that I did write this already previously. I do not belong to those, who think that it is very attractive for the readers to read the identical thoughts again and again. But in this case, to make sure that nobody does overlook this, a third time:

Make a plugin for Bart PE an additional solution besides the current AIK based one.

 

Nothing[1] has changed in RC. Sorry about that. SysRescue doesn't appear to be feature, that enhances most NOD-installations.

EDIT:
[1] Regarding the main problem: Downloading a dinsoaur and installing otherwise not wanted and needed things. SYSRescue stays a feature, which is only usable for admins which have to manage a greater number of machines and some enthusiasts. All the other NOD-users will have to pay for it, but will mostly be not able to use it.

 

meaningful silence ...

 

Hello,

The issue is being investigated.

Regards,

Aryeh Goretsky