search

quarkslab / irma-ansible-old

IRMA ansible
24 stars 10 forks source link

After reboot of physical server (probe) all modules can't find input files. #154

Closed dionis20 closed 8 years ago

dionis20 commented 8 years ago

After reboot of physical server (probe) all modules can't find input files.

ch0k0bn commented 8 years ago

Could you share a log file ?

dionis20 commented 8 years ago

Desktop.docx Probe logs rename to .zip

dionis20 commented 8 years ago

this is ZIP archive, i can't attach ZIP or TXT.

dionis20 commented 8 years ago

frontend.docx rename to .zip Here are frontend logs.

dionis20 commented 8 years ago

image

dionis20 commented 8 years ago

some samples scanned perfect, some samples triggered errors: no such file... in tmp dir VT report of errored sample

dionis20 commented 8 years ago

reboot of servers was COLD.

dionis20 commented 8 years ago

in one scan: image

2fdb28e8dec3396f986d8027bcd62e13: image

32720bffefeaef6cb40090bc3590d6b4: image

ch0k0bn commented 8 years ago

Could be linked to an AV not properly configured that delete virus file on access. Could you attach probe log file for one of the file that have no results ?

dionis20 commented 8 years ago

yes, please: probe.docx

ch0k0bn commented 8 years ago

could you manually try to copy a malware (EICAR file for example) on the probe machine to see if it is automatically detected and erased by one of the installed AV ?

dionis20 commented 8 years ago

Yes, this is it. Some AV deleting samples. And how can i turn off irma plugins?

ch0k0bn commented 8 years ago

It would be better to disable Real time scanner, could you check on the probe machine which AV has a service running and try to stop it ?

dionis20 commented 8 years ago

i will try this. How can i disable some plugins? When i was installing yara, it was generate some errors and probe_app was stop starting. When i will write my own modules, how can i on/off it and some problem-plugins?

ch0k0bn commented 8 years ago

its a missing feature at the moment. As a temporary workaround, you could force the plugin to fail at load time by adding the same line as the one in the skeleton example https://github.com/quarkslab/irma-probe/blob/master/modules/custom/skeleton/plugin.py#L53 for each module you want to disable.

dionis20 commented 8 years ago

Thanks! U've done big work! U're the best!