Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't remember which ISO's are from my MSDN and which one are from.. Online. How can you scan it to know if it is infected?

share|improve this question
Re-download the legal ones from MSDN and delete the suspect ones? – nhinkle Mar 3 '11 at 22:46

Here are a couple of ways:

Hash Verification

  1. Download HashTab and install
  2. Right click ISO, go to properties and go to the File Hash Tab
  3. Generate MD5/SHA1 hash and compare to technet


Without extracting disc contents:

  1. Download Virtual Clone Drive and install
  2. Right click ISO and select mount
  3. Scan with your favourite AV and see if it marks it as bad
  4. Download Malwarebytes Anti-Malware (MBAM) and install
  5. Scan drive with malwarebytes after update to verify malware safe

With extraction of ISO contents:

  1. Use 7zip/WinRar/WinImage/Insert Other Util Here to extract
  2. Scan extracted files to ensure clean

Safest & Longest Way

  1. Download either Virtualbox/Windows XP Mode/VMWare Player
  2. Install XP from ISO into VM
  3. Install AV/AntiMalware into VM & Update
  4. Run scan and see what happens!
share|improve this answer

You may be able to find a matching hash at TechNet.

Operating Systems -> Windows XP

If you find a match, you know it is untouched. You may have to understand the nuances of the naming & SP levels etc.

share|improve this answer

Take a look at this site to see how to mount an ISO as if it were a CD-Rom. It goes over a number of tools, most of which I've used and can recommend as good ones (daemon tools, alcohol 52%, magicdisc). The site says win 7 or vista, but those will work on XP just the same.

share|improve this answer

Extract the contents of the ISO to a folder using 7-Zip, then scan it.

Or Install it on a PC then use a Bootable AV CD to scan the system.

Make a boot AV disc then boot from the disc on the Infected PC and scan the hard drive, remove any infections it finds, I prefer the Kaspersky disc myself. The New 2010 Kaspersky disc can update the AV dat files if you are connected to the internet via ethernet at the time of scan and is suggested to update before the scan.

There could be registry entries added during install and would not be found by scanning the contents of the ISO.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .