[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: malware infesting windows part of dual-boot

Hi Charles,

On 13/01/12 19:04, Charles Blair wrote:

    I have the lenny release of debian and windows XP as a dual-
boot using grub 0.97.  The debian system (of course) seems to
be working fine, but I've gotten some malware (of course) on
the windows side.

     Can somebody recommend software (preferably free) that
will deal with the bad windows stuff without trashing the
linux system?  I'm concerned that running standard-issue
diagnostic and treatment stuff will tamper with the boot
sector, among other things.
In the past I have sometimes found it more effective and overall less time-consuming to simply re-install the system on malware-infested windows installations, than try to 'clean' them. I say this because something like the Trinity live cd may take up to 1 day or even more to scan with all the available antiviruses. If you do decide to go this route the following cautions and drawbacks come to mind:
- Be sure to back-up any valuable data both on the Windows and Debian partitions (you never know when playing around with partitioning-enabled software), this would typically include the Documents and Settings directories for the various users on the windows side, /home partition/directory on debian maybe something in /etc. - YMMV - This can usually be done by running any Live CD and attaching the machine to an external hard-disk but your mailage may vary depending on the size of data you need to backup. - Consider the fact that for the windows side any infected file you back-up still remains so, although copying it off on an external hard disk, even better if on a dedicated partition *should* reduce the risk of reinfection if you take some sanitisation measures such as having an updated, un-compromised antivirus, treating with suspicion .exe, .com, .dll, office files etc. - Reinstalling Windows XP *will* surely overwrite the MBR, thus if grub starts from there it will be unusable. But, this can easily be corrected, again through using more or less specific live CDs and googling around will provide many links. - IIRC Windows installer will offer to use whole disk thus potentially deleting your debian partition(s) too! Check *very* carefully the partitioning options of the windows installer. - In windows you will have to re-install all software. This is the biggest bummer, as it will be much more painful than e.g. re-installing all packages in debian because each software will have to be reinstalled manually. This especially applies to software with fussy authorisation methods such as sending emails, hardware snapshoting etc. A naive yet useful tip might be to print out the dir of the c:\Programs directory (or similar). In some enterprises windows machines bootstrapping is usually done to certain extent. 

Good luck,
Lorenzo.
Reply to: