-1

A friend of mine got his Vista PC infected by a virus. Before I tell him to just reboot with the maker-provided recovery DVD and lose all his data, is there a recommended Linux/*BSD live CD that he could try to clean up the mess?

Thank you.

Improve this question

6 Answers 6

Reset to default
2

Either the Ultimate Boot CD or the Windows version. I would recommend the windows PE based disk for cleaning windows systems.

Improve this answer
2
  • 1
    i can vouch for the Windows Ultimate BootCD. got me out of many holes especially with viruses. I would recommend that you add/enable the malwarebytes anti-malware plugin which I have found finds a lot of things that most anti-virus doesnt.
    – Ben Gillam
    Jul 1, 2009 at 8:01
  • Yes, definitely. I forgot this isn't default.
    – moshen
    Jul 1, 2009 at 13:02
1

I've used SystemRescueCD successfully in the past. Also there is SLAX with the NTFS-3G module. Both allowed be to transfer data from one HD to another. Make sure you scan the files before putting them on another system.

Improve this answer
1

I highly recommend doing a backup followed by a clean reinstall, it's much more secure, as you are never sure that there isn't something left even after the scanners didn't find anything anymore.

Improve this answer
1

Once a virus is detected, I take the approach that the whole installation is now suspect and should not be trusted. I don't think there's anything to be gained by trying to "clean up the mess." Cut your losses and re-install.

When a virus damages your system, there's only one way you can be certain that you've removed all traces of the virus, and that's to do a complete re-installation, including re-formatting of your drive(s). Hopefully, your friend has been performing regular backups of their system. It is now too late to do a backup as others have suggested. If you perform a backup now, you're potentially creating a virus infected backup because you cannot be sure which files have been affected by the virus. If you were to restore data from a virus infected backup, you could end up back in the same situation your friend is in now. :-(

I'd suggest a slightly different approach:

  • Locate the newest backup prior to the machine becoming infected. If your friend has not been making regular backups, this will be the lesson that will teach them to start making regular backups. :-)
  • Re-install the OS from scratch, including re-formatting the drive(s).
  • Restore from the clean backup.
Improve this answer
0

You can do it with Knoppix and ClamAV. There's tools (sorry, I forget the name) you can use on Knoppix to access the registry, but it's pretty tricky to clean out the registry. ClamAV will do fine at finding viruses in the filesystem, however. But some spyware (and viruses, I assume) will put itself all sorts of places in the registry so that it reinstalls itself.

Better option: back up the system, do a clean install, scan the files (documents, movies, music) that are still needed and copy those over. Reinstall any software from scratch and don't copy any of the registry over.

Here's some useful links:

Improve this answer
0

If you work with Windows I highly recommend Bart PE. There are a number of antivirus plug-ins available for it, as well as just about every disaster recovery tool you might need.

Improve this answer