Virus scan with Knoppix?

**lothario** · 09-06-2005, 11:21 AM

With Knoppix, I understand that I can run a virus
scan on a (potentially infected) Windows NTFS PC.

How should I do this?
Which application does this?
How will it get the latest virus definitions?

**chris-harry** · 09-06-2005, 11:57 AM

NOT RECOMENDED!! to what i know... it isnt recomended to edit any NTFS file system.... but if you want to risk it... i would sugggest

f-prot or Av-clam (it could be called av-clan)...

those two are good linux virus scanners....

**Harry Kuhman** · 09-06-2005, 12:28 PM

Chris, it was a valid question. No one said anything about editing files on a NTFS partitiion (which is a bad idea™), but scanning a Windows system with something other than that copy of Windows itself can be important. Once a nasty virus gets into a system (and this is true for any OS, not just Windows) it can gain enough control to hide itself from virus scanners. All virus scanners that run under Windows make API or System Calls to the operating system to request things like the disk sectors they want to scan. If a virus is clever enough (and this ain't rocket science), it can watch these calls and when the call that would return it's location on the disk and reveal it is made, it can just return emptry blocks or some other part of the disk. The scanner never knows it is being lied to. There are, of course, plenty of other ways to fool a scanning program once you have control of the system. Even most experienced users would never detect them. So scanning with software completely independent of the infected system is important. If you get a clean scan you have no need to write to the NTFS partition. If you detect a virus that conceals itself with a "root kit", this may be the only reasonable way that you could detect it. Only then do you need to decide what to do about it, which may well be salvage all of your data with Knoppix, reformat the disk, and completely reinstall.