In a dual-boot system, does anyone have experience dealing with viruses that hit windows from linux? (disambiguation note: dealing with them from linux .. )

The C:\ in windows is mounted to /media/disk on linux

Things I'm looking for:

  • Reading/Editing the Registry
  • Scanning for viruses and fixing them
  • Reading/Editing startup programs
  • The viruses "hit windows from linux" or the "dealing with viruses ... from linux?" – Jared Updike Jul 20 '09 at 16:56
  • 1
    aaah the dangling else problem! edited with disambiguation – hasen Jul 20 '09 at 17:04

Clamav can do this

As noted below, clam is included on a bunch of live CDs and usb bootable Linuxes (TRK) so you can check your windows machine without having to install anything on Windows.

| improve this answer | |
  • Does it also scan the registry/startup programs? – Robert Munteanu Jul 20 '09 at 17:05
  • I installed it with synaptic, but where is it? how do I use it? any link for a tutorial? – hasen Jul 20 '09 at 17:16
  • And for those who're not dual booting: ClamAV is also included on Knoppix live cds. – Arjan Jul 20 '09 at 17:17
  • I see docs are here clamav.net/doc/latest – hasen Jul 20 '09 at 17:43

Bitdefender has a Rescue Disk that boots into Knoppix and scans from there. You could either try ripping BitDefender from the disk, or just use that..

| improve this answer | |

This is what I use:


license is free for a year and reneweable, I have been using this for a while now.

Easy to install on Linux partition or Unix partition and easy to scan your mounted C: drive or other media, in addition to other binaries.

ClamAV can do the same but I think for simplicity and just scanning binaries I like how Bitdefender handles this, don't forget you have options on Linux or Unix, you can install both or just opt out and use which ever you think works best for you and your environment.

| improve this answer | |

There is TRK. A live providing (from their site):

  • full read/write and rpm support (since build 333)
  • easily reset windows passwords (backup and restore option in 3.3)
  • 4 different virusscan products integrated in a single uniform commandline with online update capability (5 in version 3.3)
  • full ntfs write support thanks to ntfs-3g (all other drivers included as well)
  • clone NTFS filesystems over the network
  • wide range of hardware support (kernel and recent kudzu hwdata)
  • easy script to find all local filesystems
  • self update capability to include and update all virusscanners
  • full proxyserver support.
  • run a samba fileserver (windows like filesharing)
  • run a ssh server
  • recovery and undeletion of files with utilities and procedures
  • recovery of lost partitions
  • evacuation of dying disks
  • UTF-8 international character support.
  • powerful multicast disk cloning utility for any filesystem
  • 2 rootkit detection uitilities (version 3.3).
  • elaborated documentation (+manpages as of 3.3).
  • elaborated documentation
| improve this answer | |

Avira runs on both, and can be installed on linux to clean up windows viruses

| improve this answer | |

Try Panda's SafeCD. It is an iso which nedds to be burnt onto a CD after download. You can boot from the CD and use it to scan/clean a windows system. The download link is here -> http://research.pandasecurity.com/archive/Panda-SafeCD-

| improve this answer | |

I tried this about a month ago with both clamav and AVG. I found AVG to be a lot faster, with less false positives. The downside to both of them is that they don't, as far as I know, clean the registry. I gather that it is possible to use a WinPE boot disk to do registry cleaning of an offline Windows install using a normal Windows virus scanning app. There are also various linux tools available to manually hack the Windows registry, but I'm not sure how you would determine what to look for and what to do with it, or if you might risk missing viruses that exist entirely in the registry.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.