Why would BitDefender Bootable Rescue CD be able to identify but unable to fix or delete malware?

Question

Why would BitDefender Bootable Rescue CD (and loads of other Rescue CDs too) be able to identify but unable to fix or delete malware? It can however put it into quarintine.

And what happens when the viruses are put into quarintine? It dosn't really mean anything if it can successfully put the malware into quarintine if it's a CD-bootable OS. It's only quarintined in the context of the memory it exists in. When I restart windows, I'm still infected with loads of viruses.

Thanks

Dave

Answer 1

Depending on the infection, it may be a modification to a required system file. I ran into this with a few infections in the past 6-7 months where ATAPI.SYS was infected. Removing the infected file renders the system unbootable, and at least early on software wasn't able to repair - just remove/rename.

The solution I ended up with for those early infection was to boot to the recovery console from an XP install CD and manually replace the affected file with a clean copy.

I've also had good luck with Kaspersky's boot CD, though you need to have a wired network connection because it must download updates unless you have a Kaspersky product installed on the PC (I believe in that situation it can use those virus signatures). The nice thing about Kaspersky is that you can open both terminal and file browser windows (Avira allows this but does it with a German keyboard layout which is annoying). This makes it fairly simple to remove the contents of the Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\Content.IE5 (or just remove the directory itself, it'll be recreated), any executables/DLLs/etc. from temp directories, and check for recently-modified exectuables, DLLs and system files. The command line does include the "find" command so you can check for recently modified files, but I don't think it includes "less" or "more". If you don't want to use find, ls -ltr is a very useful command in directories like system32.

Also, regarding quarantine: Typically that's going to mean that it renames the file (Avira adds a .XXX extension) so it's can't be located/launched when the system is rebooted to Windows. Completely removing files can be a bad idea in case of false positives.

Answer 2

UPDATE:

1. Scan with whatever scanner u would like
2. Copy the directory of the infected file on a piece of paper and/or/if go to the directory from within the bootable environment.
3. Manually delete the file(s)

---

I would try and download Avira's Boot Resue Disk and see if it can remove the malware. Maybe BitDefender cant remove them for some odd reason. I dont know y.