Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I was wondering: When an anti-virus application detects a virus and the file(s) affected is/are Windows system files, is it a good idea to

1) reboot with a bootable USB keydrive running eg. Linux + ntfs-3g, and

2) recover those files from a Windows DVD as an alternative to the Windows Recovery procedure (in case the user hasn't built a Windows Recovery in a long while)?

It seems faster/easier to just recover the original files from a DVD than restoring the whole disk from a trusted restore point, but maybe there are other issues?

Thank you.

share|improve this question

2 Answers 2

up vote 0 down vote accepted

I always copy system files from a known clean PC with the same OS and service pack level, system files on the DVD are usually outdated. SFC may work, unless the virus infected those stored backups of windows system files.

When in doubt, back up personal data and wipe the drive and re-install the OS clean, scan backed up files before transferring them to the clean installed system.

share|improve this answer
    
Thanks for the tip. I forgot that files on the DVD can be much older than what's available through Update and restoring them from a DVD could introduce some inconsistency with the rest of the system. So running "sfc /scannow" and saving the output to a remote host is a better option. –  OverTheRainbow Jan 29 '12 at 16:28
    
scannow will replace any system files that are corrupt or the wrong version, but like I said before, what if the copies it uses to replace them are infected also...personally I wipe and re-install the OS when infected. –  Moab Jan 29 '12 at 18:04
    
Mmm... So there's no reliable way other than reformating the drive and reinstalling from scratch. Thanks for the input. –  OverTheRainbow Jan 29 '12 at 22:00
    
I would not say that, its just my way of dealing with an infection on my personal computers. Some infections are very hard to remove completely and you cannot be 100% sure its gone unless you clean install. –  Moab Jan 29 '12 at 23:39

You can use sfc /scannow.

share|improve this answer
    
Please provide a link or some more information, to further complete your answer. –  wizlog Jan 30 '12 at 4:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.