Hi.

I am new to linux. I run the Fedora on my machine. I also have a copy of Knoppix-STD.

I have a friend who has a Windows XP laptop which has a virus. He let his Virus scan lapse.

I have checked on the Symantec website to find that the symptoms that he has are very common, such that there are 900+ viruses which it could be.

The main problem is that the laptop shuts itself off after about 60 seconds, so no Windows based scan would ever finsh completely.

Since I have a copy of this bootable version of linux, Knoppix STD I started thinking that perhaps I could utilize some bootable copy of Linux and then scan for/repair the virus? Is this known to be possible? It doesn't seem possible with the Knopper (Knoppix-std)


Heavyweight

Sure it is. Knoppix-std includes the ClamAV antivirus application. You can boot the laptop with the knoppix-std cdrom (you may have to set the laptop BIOS to boot from the CDROM drive). Then mount the windows drive and use clamAV to scan for viruses (probably a good idea to update the ClamAV virus definitions before-hand).

Nice! My listing of tools didn't seem to have that at first skim.

I guess the skimming was the problem.

No problem. Let us know how it turns out.

if it's just a simple virus like mydoom or whatever, boot into safe mode, run regedit and clean up whatever is trying to kick off in the "run" or "runonce"

then delete that file from the c: drive.

Symantec also has a boot floppy for this kinda virus....

Hey guys

It turned out the virus was the Sasser. I was unable to connect to the web through windows because of this infection, however I used the Knoppix STD to my advantage so that I could connect to the symantec site and retrieve the fix. I placed the fix on a Thumb drive and booted back into windows and made the fix.

I also browbeat the victim into renewing the virus subscriptions.

Thank you for your input!

Another trick you could do is Type Shutdown -i 9999 at the run line on windows and this should give you time to download patches before getting disconnected. Also setting the RPC services recovery to restart will help keep you connected.