9

In a dual-boot system, does anyone have experience dealing with viruses that hit windows from linux? (disambiguation note: dealing with them from linux .. )

The C:\ in windows is mounted to /media/disk on linux

Things I'm looking for:

  • Reading/Editing the Registry
  • Scanning for viruses and fixing them
  • Reading/Editing startup programs
2
  • The viruses "hit windows from linux" or the "dealing with viruses ... from linux?" Jul 20, 2009 at 16:56
  • 1
    aaah the dangling else problem! edited with disambiguation
    – hasen
    Jul 20, 2009 at 17:04

7 Answers 7

9

Clamav can do this

As noted below, clam is included on a bunch of live CDs and usb bootable Linuxes (TRK) so you can check your windows machine without having to install anything on Windows.

4
  • Does it also scan the registry/startup programs? Jul 20, 2009 at 17:05
  • I installed it with synaptic, but where is it? how do I use it? any link for a tutorial?
    – hasen
    Jul 20, 2009 at 17:16
  • And for those who're not dual booting: ClamAV is also included on Knoppix live cds.
    – Arjan
    Jul 20, 2009 at 17:17
  • I see docs are here clamav.net/doc/latest
    – hasen
    Jul 20, 2009 at 17:43
1

Bitdefender has a Rescue Disk that boots into Knoppix and scans from there. You could either try ripping BitDefender from the disk, or just use that..

1

This is what I use:

http://www.bitdefender.com/PRODUCT-80-en--BitDefender-Antivirus-Scanner-for-Unices.html

license is free for a year and reneweable, I have been using this for a while now.

Easy to install on Linux partition or Unix partition and easy to scan your mounted C: drive or other media, in addition to other binaries.

ClamAV can do the same but I think for simplicity and just scanning binaries I like how Bitdefender handles this, don't forget you have options on Linux or Unix, you can install both or just opt out and use which ever you think works best for you and your environment.

0

There is TRK. A live providing (from their site):

  • full read/write and rpm support (since build 333)
  • easily reset windows passwords (backup and restore option in 3.3)
  • 4 different virusscan products integrated in a single uniform commandline with online update capability (5 in version 3.3)
  • full ntfs write support thanks to ntfs-3g (all other drivers included as well)
  • clone NTFS filesystems over the network
  • wide range of hardware support (kernel 2.6.39.3 and recent kudzu hwdata)
  • easy script to find all local filesystems
  • self update capability to include and update all virusscanners
  • full proxyserver support.
  • run a samba fileserver (windows like filesharing)
  • run a ssh server
  • recovery and undeletion of files with utilities and procedures
  • recovery of lost partitions
  • evacuation of dying disks
  • UTF-8 international character support.
  • powerful multicast disk cloning utility for any filesystem
  • 2 rootkit detection uitilities (version 3.3).
  • elaborated documentation (+manpages as of 3.3).
  • elaborated documentation
0

Avira runs on both, and can be installed on linux to clean up windows viruses

0

Try Panda's SafeCD. It is an iso which nedds to be burnt onto a CD after download. You can boot from the CD and use it to scan/clean a windows system. The download link is here -> http://research.pandasecurity.com/archive/Panda-SafeCD-3.4.3.5-Released.aspx

0

I tried this about a month ago with both clamav and AVG. I found AVG to be a lot faster, with less false positives. The downside to both of them is that they don't, as far as I know, clean the registry. I gather that it is possible to use a WinPE boot disk to do registry cleaning of an offline Windows install using a normal Windows virus scanning app. There are also various linux tools available to manually hack the Windows registry, but I'm not sure how you would determine what to look for and what to do with it, or if you might risk missing viruses that exist entirely in the registry.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .