Question - Virus Removal from WinXP with Knoppix

**RandomGoon** · 03-03-2006, 04:54 PM

So here's the thing, I've gotten F-Prot to scan the hard drive and it found a ton of stuff on my friend's XP box. I've used grep to find the key words: Infection, dropper, & "security risk" and dropped them each into their own little .txt file. Now, other than parsing each file and manually deleting each infected or risky file, is there an easy way to use these files to make a script to automatically delete each file? Bear in mind I've barely gotten my feet wet inasmuch as Knoppix is concerned.

For those that want to know, I'm using the disk that came with "Knoppix Hacks" (O'Reily) and its rather friendly installation of F-Prot. I believe it's based off of 3.4. I'll be using Captive to write to an NTFS file system (yes, I'm aware of the risks...but if you know of something better to use, I'm game).

Thanks in advance,

'Goon

**nad** · 03-04-2006, 03:48 AM

Doesn't F-Prot have an "automatically delete" feature?

I could write and test a script I would be happy with in an hour or so, but, it would be easier to just connect the drive to another windoze box and then do a virus scan from a native ntfs operating system.

Either way, an operating system with "a ton of stuff" is unlikely to be the same after removal if it even boots. Backup any important data and reload.

**RandomGoon** · 03-04-2006, 09:48 AM

Well yes, I could pop, swap and scan but I'd rather not break into 2 boxen when I could just nuke the borked up files while running Knoppix. As for whether F-Prot can auto-fix/delete I can only say, not as I've seen running from the live CD (Knoppix Hacks - remastered by the author Kyle Rankin using Knoppix 3.4 as a base). I mean I could do the whole back it up and reinstall but I would rather do this just to know I can.

Thank-you though for the response!

'Goon

**Harry Kuhman** · 03-04-2006, 09:58 AM

Originally Posted by RandomGoon

.... I could pop, swap and scan but I'd rather not break into 2 boxen when I could just nuke the borked up files ..... I mean I could do the whole back it up and reinstall but I would rather ......

It has been established over and over again that captive is just not safe. It often destroys the file system in a way that is apparent immidately, but it can also damage the file system in ways that seem to work at first and only take the file system out later after you have done even more work. So even if you could manage to delete the viruses with Knoppix and this technique (and I don't think you can), you would still have to do the whole backup and reinstall if you didn't want something worse happening soon. My advice is to bite the bullet and make a real fix, not try to rig a quick fix that will only get worse later.

**RandomGoon** · 03-04-2006, 10:14 AM

I actually want to do it the "hard" way...just less hard than it could possibly be. I mean sure, before I monkey with captive I save any important data so I'm not in danger of loosing anything other than the time I'd have to invest to attempt the cleaning and/or reinstall. It's not a truly critical machine so I am free to play with it somewhat.

At any rate, risking the standard HK numbered response, what's the current "best" way to write to an NTFS partition via Knoppix? I only ask because I have thusfar had good luck with captive but I do feel the lightning seeking me out...

As always, thanks,

'Goon

**Harry Kuhman** · 03-04-2006, 11:24 AM

Originally Posted by RandomGoon

.... what's the current "best" way to write to an NTFS partition via Knoppix? I only ask because I have thusfar had good luck with captive but I do feel the lightning seeking me out...

I don't know of any current best way. My advice to anyone dead set on trying this would be to find an old copy of Knoppix before captive was removed from it.

The numbered responses are big time savers, and they allow me to give a quick response to questions that I otherwise would likely not respond to since they are so common in these forums. And some people actually have appreciated the feedback and thanked me for it. Maybe I should write a numbered section about captive (even though #6 brushes the topic slightly). But most people who know about captive seem to know it's bad for you, they just think they want to do it anyway, so I don't know what that section can tell them.

**nad** · 03-04-2006, 02:23 PM

In that case, start learning some shell scripting or ... perl. The issue is certainly straightforward and the technique is actually quite simple.

Post back with your results or problems.

**RandomGoon** · 03-04-2006, 09:17 PM

The numbered responses are big time savers, and they allow me to give a quick response to questions that I otherwise would likely not respond to since they are so common in these forums. And some people actually have appreciated the feedback and thanked me for it.

Count me in that number, Harry, I do appreciate them and thank you for your efforts.

In that case, start learning some shell scripting or ... perl.

Oh noes! More learning!

I'll just tack it on the list of things to do. Right then, guess I'd better get crackin' on it.

Thanks a bunch guys, I really do appreciate the help.

'Goon

**dvryknopper** · 03-14-2006, 12:13 AM

this is more of a question than a reply, but would the idea of using a script to delete questionable and possibly infected files on a windows machine work alright if it were formatted with fat32 instead of ntfs? I assume that it would but if there is an issue in that I am not considering please let me know

**Harry Kuhman** · 03-14-2006, 12:20 AM

Originally Posted by dvryknopper

this is more of a question than a reply, but would the idea of using a script to delete questionable and possibly infected files on a windows machine work alright if it were formatted with fat32 instead of ntfs? I assume that it would but if there is an issue in that I am not considering please let me know

You can certainly delete files on a FAT32 partition. I certainly am not telling you to use a script to delete files on your Windows system, as bad things can and do happen that way, as McAfee users are just finding out today! The concept works, but don't you suspect that software running under Linux is likely to recognize all of Windows as a virus and kindly remove it for you?