Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Why would BitDefender Bootable Rescue CD (and loads of other Rescue CDs too) be able to identify but unable to fix or delete malware? It can however put it into quarintine.

And what happens when the viruses are put into quarintine? It dosn't really mean anything if it can successfully put the malware into quarintine if it's a CD-bootable OS. It's only quarintined in the context of the memory it exists in. When I restart windows, I'm still infected with loads of viruses.

Thanks

Dave

share|improve this question

2 Answers 2

Depending on the infection, it may be a modification to a required system file. I ran into this with a few infections in the past 6-7 months where ATAPI.SYS was infected. Removing the infected file renders the system unbootable, and at least early on software wasn't able to repair - just remove/rename.

The solution I ended up with for those early infection was to boot to the recovery console from an XP install CD and manually replace the affected file with a clean copy.

I've also had good luck with Kaspersky's boot CD, though you need to have a wired network connection because it must download updates unless you have a Kaspersky product installed on the PC (I believe in that situation it can use those virus signatures). The nice thing about Kaspersky is that you can open both terminal and file browser windows (Avira allows this but does it with a German keyboard layout which is annoying). This makes it fairly simple to remove the contents of the Documents and Settings\%USERNAME%\Local Settings\Temporary Internet Files\Content.IE5 (or just remove the directory itself, it'll be recreated), any executables/DLLs/etc. from temp directories, and check for recently-modified exectuables, DLLs and system files. The command line does include the "find" command so you can check for recently modified files, but I don't think it includes "less" or "more". If you don't want to use find, ls -ltr is a very useful command in directories like system32.

Also, regarding quarantine: Typically that's going to mean that it renames the file (Avira adds a .XXX extension) so it's can't be located/launched when the system is rebooted to Windows. Completely removing files can be a bad idea in case of false positives.

share|improve this answer

UPDATE:

  1. Scan with whatever scanner u would like
  2. Copy the directory of the infected file on a piece of paper and/or/if go to the directory from within the bootable environment.
  3. Manually delete the file(s)

I would try and download Avira's Boot Resue Disk and see if it can remove the malware. Maybe BitDefender cant remove them for some odd reason. I dont know y.

share|improve this answer
    
I actually tried that before BitDefender. It didn't work either. It did find loads of infections but it couldn't cure any of them. –  DaveDev Feb 28 '10 at 20:58
    
Avira's default behavior is to identify but not to fix. If you didn't go to the configuration and tell it to repair or rename (third option, plus the checkbox under it) then it won't actually change anything. –  fencepost Feb 28 '10 at 22:31
    
Check my updated answer. –  Chris Tarazi Mar 1 '10 at 1:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.