Viruses found

[hesa666]

Please, help!
I've checked a Windows PC for viruses with Knopix' F-Prot program. Yes, it found viruses. That's why I ran it. But it just reported them.

Now, how can I fix it?

Thank you, guys, in advance. Your help will be highly appreciated.

[Harry Kuhman]

Now, how can I fix it?

Depends on a number of factors, the exact virus and the file system being two important ones. For example, if you have a NTFS partition there is no safe way at all that Linux can remove the virus, since it can't safely write to an NTFS partition. And different viruses require different removal techniques. In some cases the virus itself can just be deleted (if you get past the Linux/NTFS issue), in other cases it inserts itself into another important file, so the file needs to be replaced with a clean copy or the virus needs to be removed byte by byte. The key advantage in scanning in Knoppix isn't to remove viruses, it's to be able to search the system completely and find if there is a virus. This is something you just can't always do under Windows, if the virus takes over the system well enough it can conceal itself from anything running on the OS that it controls. Just knowing that you have a virus is a very valuable contribution fron Linux.

Yes, it found viruses.

That you actually have multiple viruses indicates that you have some very serious problems and you need to consider how you obtained these. Obviously even one virus is serious, but multiple is a clear sign that you are operating unsafely. If you have a high speed connection, I strongly suggest that you never operate without both a good software file (not the one from Microsoft) and a hardware firewall (a DSL/cable home router). And you need to consider other points of infection, running email attachments or even opening email from other than known friends without attachments; running programs downloaded from the Internet; even using known high-risk programs like IE and Outlook. Viruses are not a unavoiadable fact if you know what you are doing and exercise care; I have several systems, am constantly connected to the internet and spend way to much time on these systems on a daily basis, and I have never had a sucessful virus attack. And it's worth mentioning that I generally don't even use the MS "security updates"; the last one I installed on my Xp system was over two years ago and I've never accepted any for my Win98 systems. So if you have multiple viruses I doubt that there is even much point in removing them until you consider how you are getting them and close the holes. There is a lot of data that indicates an unprotected XP system will be taken over by multiple attacks in less than 4 minutes of going on-line, far les time than it takes to load the "security updates". So just trying to remove the viruses would be like trying to empty the ocean with a thimble unless you close your system off from more viruses first.

Beyond that, as I said, how to remove the viruses depends on what viruses and in your case how many. In extreme cases the safest thing to do might be to use Linux to back-up critical data and reinstall everything fresh (but make sure you don't back-up viruses hidden in .DOC files or other vulnerable formats in the process. Rescan all backed-up files.) But even this makes no sense if you don't close the door to new attacks.

[hesa666]

Thank you, Harry for your detailed answer

You mentioned, that KNOPPIX is not reliable with NTFS. I use ver.3.7 (and I scare to touch my NTFSes for writing now), but I heard that 3.8 should work with NTFS. Do you have any info, that 3.8 is still bad with NTFS?

Yes, there were viruses in my PC. I knew that. It was disconnected from network couple years ago, because it was hard to fix it usind infected Windows. I use it for local tasks and it works fine. Now it is the time to connect it to LAN and Net. I hoped to clean it with KNOPPIX, as it equiped with everything needed for this task by design.
Then I get disappointed.

Thank you again.
Henry

[Harry Kuhman]

.... Do you have any info, that 3.8 is still bad with NTFS?...

I saw curious vague statements of 3.8 allowing you to save a configuration even with NTFS partitions, but I never saw any good details about it. And from what I see here, people are having less luck with 3.8 and saved configurations, not better results. As far as I know there is no reason to think that 3.8.x can write safely to NTFS. So with no good info either way I'll error on the side of caution and not risk my NTFS partition. And, just worth noting, an ability to save to one specific configuration file (maybe that you might have to pre-create in Windows) is a bit different than giving Knoppix the complete ability to write, resize and delete any file or directory on an NTFS system.

A lot of the windows scanners will try to remove the viruses for you. Even free ones like AVG free. And there are frequently stand alone programs that are written to deal with a particular problem infestation. You should be able to use Knoppix to go on-line and safely download these tools (you'll of course need some place other than a NTFS partition to save them if you do it this way; I added a FAT partition to my XP system for this kind of issue, but you could use a flash device or perhaps a floppy for smaller fixes as well). Doing another scan from Linux after removing everything is highly recommended, and my advice to close off the source of the problems still holds. Good Luck.

[hesa666]

Thank you, Harry
I will try Win antiviruses as you adviced, and definitely will get much more concerned about security.

A little bit offtopic about viruses: The silly part of the story is that I have account with McAfee. I asked them to send me CD. They refused saying that downloading from their highly secured site will resolve problems Then I tried to download their stuff using KNOPPIX. The stupid site automatically replied that only IE may be used for downloading.
Do these guys understand what the real security is?

Thank you again.
So the outcome of our discussion about KNOPPIX is that KNOPPIX is good, but just auxiliary antivirus tool and it is not safe enough for NTFS yet. We have to live with that.