Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In a dual-boot system, does anyone have experience dealing with viruses that hit windows from linux? (disambiguation note: dealing with them from linux .. )

The C:\ in windows is mounted to /media/disk on linux

Things I'm looking for:

  • Reading/Editing the Registry
  • Scanning for viruses and fixing them
  • Reading/Editing startup programs
share|improve this question
The viruses "hit windows from linux" or the "dealing with viruses ... from linux?" – Jared Updike Jul 20 '09 at 16:56
aaah the dangling else problem! edited with disambiguation – hasen Jul 20 '09 at 17:04
up vote 8 down vote accepted

Clamav can do this

As noted below, clam is included on a bunch of live CDs and usb bootable Linuxes (TRK) so you can check your windows machine without having to install anything on Windows.

share|improve this answer
Does it also scan the registry/startup programs? – Robert Munteanu Jul 20 '09 at 17:05
I installed it with synaptic, but where is it? how do I use it? any link for a tutorial? – hasen Jul 20 '09 at 17:16
And for those who're not dual booting: ClamAV is also included on Knoppix live cds. – Arjan Jul 20 '09 at 17:17
I see docs are here – hasen Jul 20 '09 at 17:43

Bitdefender has a Rescue Disk that boots into Knoppix and scans from there. You could either try ripping BitDefender from the disk, or just use that..

share|improve this answer

This is what I use:

license is free for a year and reneweable, I have been using this for a while now.

Easy to install on Linux partition or Unix partition and easy to scan your mounted C: drive or other media, in addition to other binaries.

ClamAV can do the same but I think for simplicity and just scanning binaries I like how Bitdefender handles this, don't forget you have options on Linux or Unix, you can install both or just opt out and use which ever you think works best for you and your environment.

share|improve this answer

There is TRK. A live providing (from their site):

  • full read/write and rpm support (since build 333)
  • easily reset windows passwords (backup and restore option in 3.3)
  • 4 different virusscan products integrated in a single uniform commandline with online update capability (5 in version 3.3)
  • full ntfs write support thanks to ntfs-3g (all other drivers included as well)
  • clone NTFS filesystems over the network
  • wide range of hardware support (kernel and recent kudzu hwdata)
  • easy script to find all local filesystems
  • self update capability to include and update all virusscanners
  • full proxyserver support.
  • run a samba fileserver (windows like filesharing)
  • run a ssh server
  • recovery and undeletion of files with utilities and procedures
  • recovery of lost partitions
  • evacuation of dying disks
  • UTF-8 international character support.
  • powerful multicast disk cloning utility for any filesystem
  • 2 rootkit detection uitilities (version 3.3).
  • elaborated documentation (+manpages as of 3.3).
  • elaborated documentation
share|improve this answer

Avira runs on both, and can be installed on linux to clean up windows viruses

share|improve this answer

Try Panda's SafeCD. It is an iso which nedds to be burnt onto a CD after download. You can boot from the CD and use it to scan/clean a windows system. The download link is here ->

share|improve this answer

I tried this about a month ago with both clamav and AVG. I found AVG to be a lot faster, with less false positives. The downside to both of them is that they don't, as far as I know, clean the registry. I gather that it is possible to use a WinPE boot disk to do registry cleaning of an offline Windows install using a normal Windows virus scanning app. There are also various linux tools available to manually hack the Windows registry, but I'm not sure how you would determine what to look for and what to do with it, or if you might risk missing viruses that exist entirely in the registry.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .