Leading antiviruses / scanners (Kaspersky, Bitdefender, AVG, Avira, SuperAntiSpyware, MalwareBytes, ... etc. from 2k10 USB drive), AVZ cannot detect a virus in Windows 7 x64 installation that manifests itself in preventing from running Antivirus, msconfig, Office, etc. (File not found - immediately or after a small delay), but many simple programs still can start. Scanning does not give any related results.

Maybe exist some kinds of virus scanners over the world - ones that can be installed to offline Windows installation, or ones that allow to launch infected Windows in an emulator, any other for the purpose?

Are there new tools allowing to catch such an infection in the world of crooked antiviruses justifying its stupidity by rebranding in terms like rootkits / super-rootkits?

  • 1
    Can you pastebin a link to the output of the PowerShell command: Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" – HelpingHand Jun 1 '19 at 23:59
  • @ HelpingHand cmd and far in admin mode cannot be run because of virus, PowerShell commands cannot be run. If you can, please answer my question superuser.com/questions/1444463/… – WebComer Jun 3 '19 at 20:17
  • If you go to: C:\Windows\System32\WindowsPowerShell\v1.0 can you make a copy of Powershell.exe and call it something else like PSRename.exe. Double click that, do you get a PS prompt? Can you then run the previous command? – HelpingHand Jun 3 '19 at 20:23
  • @HelpingHand Lol, renaming .exe 's doesn't help. Even more complex programs start at first, but later are been stopped as a threat for a virus, seemingly because many API entry points been captured by the virus. – WebComer Jun 4 '19 at 22:17

If you have a virus that is preventing the execution of antivirus program, there are alternatives.

Several antivirus vendors have ISOs that can be imaged onto a CD, DVD, or USB drive. These drives contain their AV program and can be booted from, which skips loading the infected operating system. By not booting off of the infected drive, the virus cannot prevent the AV program from running.

Another option would be to remove the hard drive and connect to it another computer with a USB adapter. This computer can then scan and clean the infected drive, as the infected drive was not booted from.

| improve this answer | |
  • I did the scanning from usb pen drive, and the best scanners come ineffective, they found nothing.. – WebComer Jun 2 '19 at 0:41
  • My question was about, too, possible technology to force infected system to install in offline state and later run antivirus at infected system's start. – WebComer Jun 2 '19 at 7:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.