Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A friend of mine got his Vista PC infected by a virus. Before I tell him to just reboot with the maker-provided recovery DVD and lose all his data, is there a recommended Linux/*BSD live CD that he could try to clean up the mess?

Thank you.

share|improve this question

closed as off-topic by masegaloeh, Jenny D, Ward, Andrew Schulman, Katherine Villyard Apr 12 '15 at 14:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions on Server Fault must be about managing information technology systems in a business environment. Home and end-user computing questions may be asked on Super User, and questions about development, testing and development tools may be asked on Stack Overflow." – masegaloeh, Jenny D, Ward, Andrew Schulman, Katherine Villyard
If this question can be reworded to fit the rules in the help center, please edit the question.

Either the Ultimate Boot CD or the Windows version. I would recommend the windows PE based disk for cleaning windows systems.

share|improve this answer
i can vouch for the Windows Ultimate BootCD. got me out of many holes especially with viruses. I would recommend that you add/enable the malwarebytes anti-malware plugin which I have found finds a lot of things that most anti-virus doesnt. – Ben Gillam Jul 1 '09 at 8:01
Yes, definitely. I forgot this isn't default. – moshen Jul 1 '09 at 13:02

I've used SystemRescueCD successfully in the past. Also there is SLAX with the NTFS-3G module. Both allowed be to transfer data from one HD to another. Make sure you scan the files before putting them on another system.

share|improve this answer

I highly recommend doing a backup followed by a clean reinstall, it's much more secure, as you are never sure that there isn't something left even after the scanners didn't find anything anymore.

share|improve this answer

Once a virus is detected, I take the approach that the whole installation is now suspect and should not be trusted. I don't think there's anything to be gained by trying to "clean up the mess." Cut your losses and re-install.

When a virus damages your system, there's only one way you can be certain that you've removed all traces of the virus, and that's to do a complete re-installation, including re-formatting of your drive(s). Hopefully, your friend has been performing regular backups of their system. It is now too late to do a backup as others have suggested. If you perform a backup now, you're potentially creating a virus infected backup because you cannot be sure which files have been affected by the virus. If you were to restore data from a virus infected backup, you could end up back in the same situation your friend is in now. :-(

I'd suggest a slightly different approach:

  • Locate the newest backup prior to the machine becoming infected. If your friend has not been making regular backups, this will be the lesson that will teach them to start making regular backups. :-)
  • Re-install the OS from scratch, including re-formatting the drive(s).
  • Restore from the clean backup.
share|improve this answer

You can do it with Knoppix and ClamAV. There's tools (sorry, I forget the name) you can use on Knoppix to access the registry, but it's pretty tricky to clean out the registry. ClamAV will do fine at finding viruses in the filesystem, however. But some spyware (and viruses, I assume) will put itself all sorts of places in the registry so that it reinstalls itself.

Better option: back up the system, do a clean install, scan the files (documents, movies, music) that are still needed and copy those over. Reinstall any software from scratch and don't copy any of the registry over.

Here's some useful links:

share|improve this answer

If you work with Windows I highly recommend Bart PE. There are a number of antivirus plug-ins available for it, as well as just about every disaster recovery tool you might need.

share|improve this answer