up vote 2 down vote favorite
share [g+] share [fb]

I was wondering: When an anti-virus application detects a virus and the file(s) affected is/are Windows system files, is it a good idea to

1) reboot with a bootable USB keydrive running eg. Linux + ntfs-3g, and

2) recover those files from a Windows DVD as an alternative to the Windows Recovery procedure (in case the user hasn't built a Windows Recovery in a long while)?

It seems faster/easier to just recover the original files from a DVD than restoring the whole disk from a trusted restore point, but maybe there are other issues?

Thank you.

link|improve this question
60% accept rate
feedback

2 Answers

up vote 0 down vote accepted

I always copy system files from a known clean PC with the same OS and service pack level, system files on the DVD are usually outdated. SFC may work, unless the virus infected those stored backups of windows system files.

When in doubt, back up personal data and wipe the drive and re-install the OS clean, scan backed up files before transferring them to the clean installed system.

link|improve this answer
Thanks for the tip. I forgot that files on the DVD can be much older than what's available through Update and restoring them from a DVD could introduce some inconsistency with the rest of the system. So running "sfc /scannow" and saving the output to a remote host is a better option. – OverTheRainbow Jan 29 at 16:28
scannow will replace any system files that are corrupt or the wrong version, but like I said before, what if the copies it uses to replace them are infected also...personally I wipe and re-install the OS when infected. – Moab Jan 29 at 18:04
Mmm... So there's no reliable way other than reformating the drive and reinstalling from scratch. Thanks for the input. – OverTheRainbow Jan 29 at 22:00
I would not say that, its just my way of dealing with an infection on my personal computers. Some infections are very hard to remove completely and you cannot be 100% sure its gone unless you clean install. – Moab Jan 29 at 23:39
feedback
up vote 4 down vote

You can use sfc /scannow.

link|improve this answer
Please provide a link or some more information, to further complete your answer. – wizlog Jan 30 at 4:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.