<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Zod.hu</title>
	<atom:link href="http://zod.hu/feed" rel="self" type="application/rss+xml" />
	<link>http://zod.hu</link>
	<description>Phase one: Linux, phase two: , phase three: profit!</description>
	<lastBuildDate>Wed, 11 Nov 2009 04:16:08 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=3.2.1</generator>
		<item>
		<title>Working with sms/mms in Android</title>
		<link>http://zod.hu/2009/11/working-with-smsmms-in-android.html</link>
		<comments>http://zod.hu/2009/11/working-with-smsmms-in-android.html#comments</comments>
		<pubDate>Wed, 11 Nov 2009 04:16:08 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[Documenting the Undocumented]]></category>
		<category><![CDATA[Android]]></category>
		<category><![CDATA[hidden api]]></category>
		<category><![CDATA[mms]]></category>
		<category><![CDATA[sms]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=56</guid>
		<description><![CDATA[Important Although the following methods can be used to access messages on the Android platform, the API is probably hidden from developers for a reason. I think it&#8217;s hidden because mobile manufacturers are free to implement messaging as they like and the messaging application provided by Google is there only because every mobile platform needs [...]]]></description>
			<content:encoded><![CDATA[<p><strong>Important</strong></p>
<p>Although the following methods can be used to access messages on the Android platform, the API is probably hidden from developers for a reason.</p>
<p>I think it&#8217;s hidden because mobile manufacturers are free to implement messaging as they like and the messaging application provided by Google is there only because every mobile platform needs messaging. I&#8217;m just guessing though&#8230;</p>
<p>Everything which is not in the official API reference is likely to change between releases and can also disappear without notice. Probably the API will be available with minor changes in &#8220;Google Experience&#8221; labeled phones because these devices ship the unmodified release builds, however there are already problems with this API on Hero, which is heavily customized by the manufacturer.</p>
<p>So think of this API as a reference implementation of messaging provided by the Google developers, which may or may not be available on an Android based device.</p>
<p><strong>What we know</strong></p>
<p>The official API has <a href="http://developer.android.com/reference/android/telephony/SmsManager.html" target="_blank">SmsManager</a> to send sms.</p>
<p>For some reason android.provider.Telephony is hidden in the SDK although it is still in the /frameworks/base/core/java/ directory which in my reading should be public and usable to app developers. Let&#8217;s pretend for now that this is a mistake and it is public. This file has the [public static final String SMS_RECEIVED_ACTION = "android.provider.Telephony.SMS_RECEIVED"] broadcast intent to capture incoming messages. You have to hardcode the string &#8220;android.provider.Telephony.SMS_RECEIVED&#8221; in the intent-filter but at least it&#8217;s defined in the core.</p>
<p><strong>Reading/Writing messages</strong></p>
<p>Here comes the part which is NOT in the core platform. Everything is defined in the /packages/providers/TelephonyProvider/ directory. Accessing messages can be done through the standard ContentProvider API. The usable Uri-s are:</p>
<p><em><br />
content:// +</em></p>
<p>sms</p>
<ul>
<li>retreive all messages</li>
</ul>
<p>sms/inbox<br />
sms/sent<br />
sms/draft<br />
sms/outbox</p>
<ul>
<li>retreive messages from the respective folders</li>
</ul>
<p>sms/#<br />
sms/inbox/#<br />
sms/sent/#<br />
sms/draft/#<br />
sms/outbox/#</p>
<ul>
<li>retreive a messages identified by its _id (Because _id-s are unique, all of the above maps to a select based on the message _id)</li>
</ul>
<p>sms/undelivered<br />
sms/failed<br />
sms/failed/#<br />
sms/queued<br />
sms/conversations<br />
sms/conversations/*<br />
sms/raw<br />
sms/attachments<br />
sms/attachments/#<br />
sms/threadID<br />
sms/threadID/*<br />
sms/status/#<br />
sms/sr_pending<br />
sms/icc<br />
sms/icc/#</p>
<ul>
<li>List/retreive messages from SIM</li>
</ul>
<p>sms/sim<br />
sms/sim/#</p>
<ul>
<li>Deprecated Uris, &#8220;sim&#8221; replaced by &#8220;icc&#8221;</li>
</ul>
<p>To be continued&#8230; I have to find some answers from the platform developers first :)</p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/11/working-with-smsmms-in-android.html/feed</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Setting up your android phone</title>
		<link>http://zod.hu/2009/06/setting-up-your-android-phone.html</link>
		<comments>http://zod.hu/2009/06/setting-up-your-android-phone.html#comments</comments>
		<pubDate>Fri, 05 Jun 2009 19:24:16 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[Settings]]></category>
		<category><![CDATA[Android]]></category>
		<category><![CDATA[mcc]]></category>
		<category><![CDATA[mnc]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=49</guid>
		<description><![CDATA[These are the settings for an android powered phone for T-Mobile in Hungary. However the link at the end of this post could help with a lot more countries and mobile operators. Android settings for T-Mobile (Hungary): Name: T-Mobile H APN: internet Proxy: 212.051.126.002 Port: 8080 Username: &#60;Not set&#62; Password: &#60;Not set&#62; Server: &#60;Not set&#62; [...]]]></description>
			<content:encoded><![CDATA[<p>These are the settings for an android powered phone for T-Mobile in Hungary. However the link at the end of this post could help with a lot more countries and mobile operators.</p>
<p><strong>Android settings for T-Mobile (Hungary):</strong></p>
<p>Name: T-Mobile H<br />
APN: internet<br />
Proxy: 212.051.126.002<br />
Port: 8080<br />
Username: &lt;Not set&gt;<br />
Password: &lt;Not set&gt;<br />
Server: &lt;Not set&gt;<br />
MMSC: http://mms.t-mobile.hu/servlets/mms<br />
MMS Proxy: 212.051.126.010<br />
MMS Port: 8080<br />
MCC: 216<br />
MNC: 30<br />
APN type: &lt;Not set&gt;</p>
<p>Every setting above is available from your network operator (in Hungary the T-Mobile website contains a lot of documents about how to set up various phones to use in their network. If your operator has them too, just look at the settings of a fairly recent 3G capable phone for this information).</p>
<p>The only thing you won&#8217;t find is the setting for MCC and MNC (these are Mobile Country Code and Mobile Network Code) these two values are unique for every country and every operator (MCC: 216 for Hungary, MNC: 30 for T-Mobile in Hungary [01 for Pannon, 70 for Vodafone]).</p>
<p>But there is a really good list on Wikipedia: <a href="http://en.wikipedia.org/wiki/Mobile_network_code">Mobile Network Code</a></p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/06/setting-up-your-android-phone.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Connecting Samba servers through OpenVPN</title>
		<link>http://zod.hu/2009/04/connecting-samba-servers-through-openvpn.html</link>
		<comments>http://zod.hu/2009/04/connecting-samba-servers-through-openvpn.html#comments</comments>
		<pubDate>Thu, 23 Apr 2009 11:26:03 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[Config]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[multiple subnets]]></category>
		<category><![CDATA[openvpn]]></category>
		<category><![CDATA[samba]]></category>
		<category><![CDATA[vpn]]></category>
		<category><![CDATA[windows networking]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=42</guid>
		<description><![CDATA[Connecting two different subnets on different locations with linux firewalls is easy. I did it with OpenVPN because it&#8217;s easy to setup, secure and &#8220;just works&#8221;. Everything worked fine. Email server on one subnet was reachable from the other, the samba server was available with \\ip style address. I thought that was all, work done&#8230; [...]]]></description>
			<content:encoded><![CDATA[<p>Connecting two different subnets on different locations with linux firewalls is easy. I did it with OpenVPN because it&#8217;s easy to setup, secure and &#8220;just works&#8221;.</p>
<p>Everything worked fine. Email server on one subnet was reachable from the other, the samba server was available with \\ip style address. I thought that was all, work done&#8230;</p>
<p>Not quite.<br />
<span id="more-42"></span><br />
Well we had domain logons with roaming profiles before the subnet split and we wanted it to stay the same. </p>
<p>Before I go into detail about the problems and solutions lets take a look at our simplified network.<br />
The two firewalls are connected with adsl through ppp0.<br />
Subnet1 has an internal network with 192.168.1.0/24 with the server ip 192.168.1.254 and a tun0 interface with 10.8.0.1.<br />
Subnet2 has 192.168.2.0/24 (ip 192.168.2.254) with tun0 10.8.0.6.<br />
Because we have limited number of servers both firewalls are also the samba servers. (However the setup is the same if you have internal samba servers, just change the ip addresses).</p>
<p>Subnet2 has the domain controller for DOMAIN1.</p>
<p>Server on Subnet1 is called SERVER2 on Subnet2 it&#8217;s SERVER, sorry for this we have a switched setup and I don&#8217;t want to tamper with the included logs.</p>
<p><b>Configuration</b></p>
<p>We need a WINS server on our network. Let SERVER (192.168.2.254) be it:</p>
<p>smb.conf on SERVER:</p>
<pre>
netbios name = SERVER
workgroup = DOMAIN1
os level = 128
preferred master = Yes
domain master = Yes
local master = Yes

wins support = Yes
wins proxy = Yes

# If you want domain logons just turn on the relevant options
</pre>
<p>smb.conf on SERVER2</p>
<pre>
netbios name = SERVER2
workgroup = DOMAIN1
os level = 64
preferred master = Yes
domain master = No
local master = Yes

wins support = No
wins proxy = No
wins server = 192.168.2.254
</pre>
<p>It is important to switch on wins support = Yes on only one server per workgroup!</p>
<p>Ok now we have name resolution for NetBIOS names set up.</p>
<p>If you have dhcp for your subnets put option netbios-name-servers 192.168.2.254; in dhcpd.conf so your clients will know about our WINS server (you can also put option netbios-node-type 8; this will change the clients NetBIOS name resolution to WINS server and network broadcast in this order)</p>
<p><b>Problem 1</b></p>
<p>This one is quite important and hard to notice.<br />
If you have </p>
<pre>
interfaces = 127.0.0.0/8 eth1 ...
bind interfaces only = yes
</pre>
<p>Comment it out now! The problem is with this setup is no matter how hard you try to add tun0 (or tun0 ip range) to this config samba will refuse to use this interface because it has no broadcast capability. And the traffic between the two servers will go through the tunnel and use the tun0 ip for source, and in turn samba will refuse inter samba communication from this source.</p>
<p>The relevant log file entries are not too informative:</p>
<p>On the WINS server:</p>
<pre>
[2009/04/22 16:53:16,  3, pid=26633, effective(0, 0), real(0, 0)] nmbd/nmbd_winsserver.c:wins_multihomed_register_query_fail(1491)
  wins_multihomed_register_query_fail: Registering machine at IP 192.168.1.254 failed to answer query successfully for name SERVER2&lt;20&gt;.
</pre>
<p>On the other server:</p>
<pre>
[2009/04/22 16:53:26, 0, pid=30630, effective(0, 0), real(0, 0)] nmbd/nmbd_namelistdb.c:standard_fail_register(305)
  standard_fail_register: Failed to register/refresh name SERVER2&lt;03&gt; on subnet UNICAST_SUBNET
[2009/04/22 16:53:26, 0, pid=30630, effective(0, 0), real(0, 0)] nmbd/nmbd_nameregister.c:register_name_response(130)
  register_name_response: WINS server at IP 192.168.2.254 rejected our name registration of SERVER2&lt;00&gt; IP 192.168.1.254 with error code 5.
</pre>
<p><b>Problem 2</b></p>
<p>On each subnet only the host which reside on the same subnet are visible to the clients. We have to force our other server(s) to sync its browse list with the WINS server. This can be done by adding the following to the config of the WINS server.</p>
<pre>
# This forces samba to announce itself to 192.168.1.254 (our local master browser on the other subnet)
# and also on the broadcast address, just to be sure it reaches the clients.
remote announce = 192.168.1.254 192.168.1.255

# This forces the lmb 192.168.1.254 to sync its browse list with us.
remote browse sync = 192.168.1.254
</pre>
<p><b>Problem 3</b></p>
<p>As I said before we have domain logons enabled. Without the above changes joining the domain was easy (just like with a single subnet) however the clients were unable to log in to the domain. The error was at login time after selecting the domain to log on and entering user/pass information and it said something like &#8220;Domain DOMAIN1 not available&#8221;. No details, no errors. Sometimes I was able to log in but the client machine was unable to mount the network drives from the server. After digging into the problem it boiled down to NetBIOS name resolution. So the changes above seems to solve this issue as well.</p>
<p>Now we are done :)</p>
<p><b>Final thoughts</b></p>
<p>MS networking is complicated and unreliable. I really hate it. Broadcasting, elections, resolution order changes&#8230;<br />
So do not ever trust it! Browsing the network was never easy either and I don&#8217;t think it ever will be. </p>
<p>Oh and also as of samba 3.2.3 XP clients don&#8217;t seem to need the signorseal registry hack, however in local policy/security setting you should disable &#8220;&#8230;signing and encrypting (always)&#8221;. </p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/04/connecting-samba-servers-through-openvpn.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The best SSD article to date</title>
		<link>http://zod.hu/2009/04/the-best-ssd-article-to-date.html</link>
		<comments>http://zod.hu/2009/04/the-best-ssd-article-to-date.html#comments</comments>
		<pubDate>Mon, 13 Apr 2009 23:47:56 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[SSD]]></category>
		<category><![CDATA[Hardware]]></category>
		<category><![CDATA[performance]]></category>
		<category><![CDATA[technical]]></category>
		<category><![CDATA[the truth]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=39</guid>
		<description><![CDATA[For months now I&#8217;ve been reading about SSDs. First I was just curious whether they could really outperform HDDs. Later I considered them for my personal use in laptops. Now I&#8217;ve found the best in depth article about SSDs. It&#8217;s a bit long but it contains a lot of information for professionals, who really know [...]]]></description>
			<content:encoded><![CDATA[<p>For months now I&#8217;ve been reading about SSDs. First I was just curious whether they could really outperform HDDs. Later I considered them for my personal use in laptops.</p>
<p>Now I&#8217;ve found the best in depth article about SSDs. It&#8217;s a bit long but it contains a lot of information for professionals, who really know something about hardware and want to know what an SSD can do and what limitations does it have which can affect everyday use.</p>
<p>The article can be found here:<br />
<a href="http://www.anandtech.com/storage/showdoc.aspx?i=3531">[AnandTech] The SSD Anthology: Understanding SSDs and New Drives from OCZ</a></p>
<p>Now my last unanswered question about SSDs: &#8220;How long do they last really?&#8221;</p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/04/the-best-ssd-article-to-date.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Simple ~/.vimrc</title>
		<link>http://zod.hu/2009/03/simple-vimrc.html</link>
		<comments>http://zod.hu/2009/03/simple-vimrc.html#comments</comments>
		<pubDate>Sun, 08 Mar 2009 12:09:28 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[Easier life]]></category>
		<category><![CDATA[.vimrc]]></category>
		<category><![CDATA[config]]></category>
		<category><![CDATA[indentation]]></category>
		<category><![CDATA[reformat]]></category>
		<category><![CDATA[tabs]]></category>
		<category><![CDATA[vim]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=34</guid>
		<description><![CDATA[Yesterday I changed my ~/.vimrc to make programming in a terminal easier. For years now I&#8217;ve been reusing the same one. Here it is with comments: " Turn on syntax highlights. Well it's not an IDE, but makes important things stand out enough syntax on " Make tab width 4 spaces set tabstop=4 " Make [...]]]></description>
			<content:encoded><![CDATA[<p>Yesterday I changed my ~/.vimrc to make programming in a terminal easier. For years now I&#8217;ve been reusing the same one.</p>
<p>Here it is with comments:</p>
<pre>
" Turn on syntax highlights. Well it's not an IDE, but makes important things stand out enough
syntax on
" Make tab width 4 spaces
set tabstop=4
" Make indent width also 4
set shiftwidth=4
" Make indent rounded to next full shift width
set shiftround
" Expand tabs to spaces (doesn't mess up file indentation in other editors width different tab settings)
set expandtab
" Indent code blocks automatically (don't need to type a lot of tabs in deep indented lines after a linebreak)
set autoindent
" And make backspace delete smartly (like in any editor. through indents, linestarts and end of lines)
set backspace=indent,eol,start
</pre>
<p>And finally a command to remember to replace all tabs with spaces based on the values above. (Good for formatting text made in another editor)</p>
<pre>
:retab or :retab! to force replacing all tabs which are not surrounded by whitespaces
</pre>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/03/simple-vimrc.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Using Java classes in JavaFX</title>
		<link>http://zod.hu/2009/02/using-java-classes-in-javafx.html</link>
		<comments>http://zod.hu/2009/02/using-java-classes-in-javafx.html#comments</comments>
		<pubDate>Mon, 23 Feb 2009 14:14:04 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[JavaFX]]></category>
		<category><![CDATA[interoperability]]></category>
		<category><![CDATA[java]]></category>
		<category><![CDATA[Programming]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=11</guid>
		<description><![CDATA[&#8220;You can leverage the power of Java by using any Java library within a JavaFX application. This way you can preserve your investment in Java and use JavaFX to build engaging visual experiences.&#8221; The statement above is in the JavaFX FAQ at 4.4. And of course you can use any java library available without any [...]]]></description>
			<content:encoded><![CDATA[<p>&#8220;You can leverage the power of Java by using any Java library within a JavaFX application. This way you can preserve your investment in Java and use JavaFX to build engaging visual experiences.&#8221;</p>
<p>The statement above is in the JavaFX FAQ at 4.4. And of course you can use any java library available without any changes.</p>
<p>However try to bind a variable form a simple java class to any value in a javafx class and you will see that integrating java into javafx is not as simple as it seems.</p>
<p><span id="more-11"></span><br />
The problem is with the implementation of binding in javafx. All of the built in data types in javafx are actually wrappers around java data types. You can think about them as event sources. Whenever the value changes the wrapper will notify all related variables which are bound to this variable. (If you know property change listeners you will notice the similarity).</p>
<p>However normal java data types are not wrapped, so if you want to use them in javafx binding you have to code a bit more.</p>
<p>This is a solution I posted on the javafx forum at sun:</p>
<p>The Thread which updates a value in every second:</p>
<pre>
// TimeServer.java
public class TimeServer extends Thread {

    private boolean interrupted = false;
    public ValueObject valueObject = new ValueObject();

    @Override
    public void run() {
        while (!interrupted) {
            try {
                valueObject.setValue(Long.toString(System.currentTimeMillis()));
                sleep(1000);
            } catch (InterruptedException ex) {
                interrupted = true;
            }
        }
    }
}
</pre>
<p>The ValueObject class which contains the values we want to bind in javafx:</p>
<pre>
// ValueObject.java
import java.util.Observable;

public class ValueObject extends Observable {

    private String value;

    public String getValue() {
        return this.value;
    }

    public void setValue(String value) {
        this.value = value;
        fireNotify();
    }

    private void fireNotify() {
        setChanged();
        notifyObservers();
    }
}
</pre>
<p>We also need an adapter class in JFX so we can use bind:</p>
<pre>
// ValueObjectAdapter.fx
import java.util.Observer;
import java.util.Observable;

public class ValueObjectAdapter extends Observer {

    public-read var value : String;
    public var valueObject : ValueObject
        on replace { valueObject.addObserver(this)}

    override function update(observable: Observable, arg: Object) {
         // We need to run every code in the JFX EDT
         // do not change if the update method can be called outside the Event Dispatch Thread!
         FX.deferAction(
             function(): Void {
                value = valueObject.getValue();
             }
         );
     }

}
</pre>
<p>And finally the main JFX code which displays the canging value:</p>
<pre>
// Main.fx
import javafx.stage.Stage;
import javafx.scene.Scene;
import javafx.scene.text.Text;
import javafx.scene.text.Font;
import threadbindfx.TimeServer;

var timeServer : TimeServer;
var valueObjectAdapter : ValueObjectAdapter = new ValueObjectAdapter();
timeServer = new TimeServer();
valueObjectAdapter.valueObject = timeServer.valueObject;

timeServer.start();

Stage {
    title: "Time Application"
    width: 250
    height: 80
    scene: Scene {
        content: Text {
            font : Font {
                size : 24
            }
            x : 10, y : 30
            content: bind valueObjectAdapter.value;
        }
    }
}
</pre>
<p>I hope this helps until sun comes out with a better solution.</p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/02/using-java-classes-in-javafx.html/feed</wfw:commentRss>
		<slash:comments>14</slash:comments>
		</item>
		<item>
		<title>Linux against spyware</title>
		<link>http://zod.hu/2009/02/linux-against-spyware.html</link>
		<comments>http://zod.hu/2009/02/linux-against-spyware.html#comments</comments>
		<pubDate>Mon, 23 Feb 2009 13:12:53 +0000</pubDate>
		<dc:creator>Zod</dc:creator>
				<category><![CDATA[Virus/Spyware]]></category>
		<category><![CDATA[antispyware]]></category>
		<category><![CDATA[antivirus]]></category>
		<category><![CDATA[Linux]]></category>
		<category><![CDATA[livecd]]></category>
		<category><![CDATA[ubuntu]]></category>
		<category><![CDATA[windows]]></category>

		<guid isPermaLink="false">http://zod.hu/?p=5</guid>
		<description><![CDATA[I wanted to write about a bit of spyware history and evolution here, but I think we all know a lot about the problem already. Spywares are annoying, widespread and dangerous. And hard to get rid of. Today spyware writers are becoming quite good at hiding spyware activity and making sure that an infected computer [...]]]></description>
			<content:encoded><![CDATA[<p>I wanted to write about a bit of spyware history and evolution here, but I think we all know a lot about the problem already. Spywares are annoying, widespread and dangerous.</p>
<p>And hard to get rid of. Today spyware writers are becoming quite good at hiding spyware activity and making sure that an infected computer remains infected. A common approach is to change the winlogon notify registry key to run malware code on every single user login. Yes, even if you start windows in safe mode you have to log in, and if a program is loaded you cannot easily remove it from the computer.</p>
<p><span id="more-5"></span></p>
<p>This is an everyday problem for most IT professionals. Cleaning a system that&#8217;s already running is almost impossible.</p>
<p>So linux for the rescue:</p>
<p>My solution for the problem is a linux live cd with an antivirus removal tool.</p>
<p>The easy part was the live cd. <a href="http://www.ubuntu.com" target="_blank">Ubuntu</a> has a nice live system which is easy to <a href="https://help.ubuntu.com/community/LiveCDCustomization" target="_blank">customize</a>, supports almost every available hardware, and also has mature NTFS support.</p>
<p>I got rid of openoffice.org packages because they took up a lot of space, which I needed for the antivirus software.</p>
<p>The harder part was finding the ideal virus removal tool for the job. I really like <a href="http://www.clamav.net/" target="_blank">clamav</a> (we use it to scan our email traffic for obvious viruses) however as of today it knows 472153 viruses. Don&#8217;t get me wrong it IS a great tool for slowly evolving or fixed viruses, like mass mailing viruses and older ones, but currently not fast enough for the spyware war. On my first attempts with the live antivir solution it missed a lot newer threats and variants.</p>
<p>So I started to look for another solution. Well &#8220;linux and viruses&#8221; wasn&#8217;t the best search term, but in the end I found a very promising site: <a href="http://www.viruspool.net/antivirus.cms">Viruspool.net</a>. This site is exactly what I&#8217;ve been looking for. It lists unix command line scanners with a percentage of accuracy, ease of install, price and such information. Although it is a bit outdated, but still a good reference point.</p>
<p>Obviously I aimed at the highest accuracy, but because I wanted only to testdrive the products simple availability was important too.</p>
<p>To make a long story short I ended up with the <a href="http://www.bitdefender.com/" target="_blank">BitDefender</a> product (evaluation version is available after filling a simple form) and they currently run a beta test program for the unix version. They sent me an email about it, so I think I can include the link here http://download.bitdefender.com/SMB/Workstation_Security_and_Management/BitDefender_Antivirus_Scanner_for_Unices/Unix/Beta/</p>
<p>Today it has 2 336 009 signatures, and a lot of it is malware related.</p>
<p>So after creating the live cd I booted the machine with it and simply did this:</p>
<pre>#Update the definitions
bdscan --update
# Mounted the windows partition (in read only mode at first)
mount -o ro /dev/sda1 /mnt
cd /mnt
bdscan --no-list path/to/check</pre>
<p>This gave me the list of infected files, but did not change anything on the machine in question.<br />
(On this particular machine, a lot of expected dll-s and .tmp files and an unexpected trojan infection in userinit.exe [this caused the owner to ask for help, because it made the desktop disappear on boot... badly written trojan...]).</p>
<p>This was enough for me. Remounted the drive in rw mode, removed the infections by hand and replaced userinit.exe with a clean copy.</p>
<p>But bdscan can also remove/quarantine/repair(!) infections automaticaly. See <code>bdscan --help</code> for details.</p>
<p>Now I&#8217;m quite satisfied with the result.</p>
<p>If I&#8217;ll have a bit free time I&#8217;ll check more of the products even if it&#8217;s a bit harder to get them.<br />
The more engines I try the more spyware I&#8217;ll catch, and I currently have quite a few machines to check for malware&#8230;</p>
<p>After creating the live cd you can remove /opt/BitDefender-scanner/var/bddt.dat this will keep the software in trial mode, but must be run as root to be able to recreate the file.</p>
<p>I hope this helps a bit, and of course every comment is welcome :)</p>
]]></content:encoded>
			<wfw:commentRss>http://zod.hu/2009/02/linux-against-spyware.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

