If i boot into Knoppix on an infested machine

[Esquire]

infested windows box can i run a virus and spyware scan in knoppix and will it pick up windows viruses?

thanks

 

[n0cmonkey]

Probably using something like clamav. I'm not sure about the NTFS write capabilities of knoppix though.

I wouldn't trust the machine though, once it's infected it's toast.

 

[Esquire]

if i ran an online scan you think?

if it would work it'd be cool

 

[n0cmonkey]

Originally posted by: Esquire
if i ran an online scan you think?

if it would work it'd be cool

It's too tough to be sure you got everything these days. Nuke the site from orbit, it's the only way to be sure.

 

[Esquire]

"But he'a grunt, no offense...
None taken"

ok yeah thats true

thanks, i'll try it at somepoint, but nuking is prolly best

 

[Brazen]

Generally, people just use knoppix to recover files and such from the computer and then nuke it. You could run a virus scan and it would detect the virus, but probably not be able to clean the files (do to write limitations with ntfs drives - I'm also not too sure about this).

 

[Esquire]

wouldn't it be cool if it could

 

[Slowlearner]

Use an updated UBCD for windows http://www.ubcd4win.com/. Of course you may need access to another PC to create one, but it will be more useful than Knoppix.

 

[Nothinman]

wouldn't it be cool if it could

It's possible if you want to trust Captive-NTFS or Fuse-NTFS to write to the drive, I don't think either are included with Knoppix anymore though.

 

[mchammer]

Try out BartsPE, it's perfect for this. When you make it you can put in anti-virus and anti-spyware. Plus it has network support if you need to move files.

 

[silverpig]

Originally posted by: Nothinman

wouldn't it be cool if it could

It's possible if you want to trust Captive-NTFS or Fuse-NTFS to write to the drive, I don't think either are included with Knoppix anymore though.

And if he's going to nuke the drive as his alternative anyways, it might be worth a shot... straight nuking is probably the quickest way though.

 

[htne]

I usually remove the infected hard drive, and attach it as a secondary hard drive on another, known good system. Then I can run anti-virus and anti-trojan (like Ewido). If anything short of nuking will work, this is it.

 

[sciencewhiz]

I beleive the newer versions of knoppix include a script to download f-prot and scan your windows partitions.

edit: http://hacks.oreilly.com/pub/h/2521