[TriLUG] Rescue CD

[Charles Fischer via TriLUG]

I use an older version of System Rescue CD.  I think 4.0.1 has ClamAV.
Here is the link:
http://sourceforge.net/projects/systemrescuecd/files/sysresccd-x86/4.0.1/
I mount the Windows disk and create a virus directory.  Then I download the
latest virus definitions to that directory and run the scan.

Dropping ClamAV from the newer distro seems like a big mistake to me.

Be careful, ClamAV does not try to repair DLLs, it just deletes them (at
least if you use that option), so you could end up with a nonbootable
Windows system, vs the unusable one you have now.

Good luck,
Charles


On Wed, Apr 15, 2015 at 8:21 AM, David Both via TriLUG <trilug at trilug.org>
wrote:

> I am trying to find a good, recent rescue CD that I can use to rescue
> Windows systems up through 8.1. There are several apparently well-regarded
> ones out there, but most have not been updated for a few years. My primary
> criteria are that it must run Linux and that it must be able to scan for
> current new malware, viruses, spyware, Trojans, etc.
>
> I have a customer with a Win8.1 box that is heavily infected. He has
> someone whom he uses for this, and I have recommended another person who
> was recommended to me by Intrex. I would just like to be able to do this
> myself when I run into these types of issues since I am already on-site and
> trying to resolve problems that may be related or affected by these
> infections.
>
> I am already testing Hiren's Boot Disk, SystemRescueCD and Trinity Rescue
> Kit.
>
> Any and all suggestions will be appreciated. Thanks!
>
> --
>
>
> *********************************************************
> David P. Both, RHCE
> Millennium Technology Consulting LLC
> Raleigh, NC, USA
> 919-389-8678
>
> dboth at millennium-technology.com
>
> www.millennium-technology.com
> www.databook.bz - Home of the DataBook for Linux
> DataBook is a Registered Trademark of David Both
> *********************************************************
> This communication may be unlawfully collected and stored by the National
> Security Agency (NSA) in secret. The parties to this email do not consent
> to the
> retrieving or storing of this communication and any related metadata, as
> well as
> printing, copying, re-transmitting, disseminating, or otherwise using it.
> If you
> believe you have received this communication in error, please delete it
> immediately.
>
> --
> This message was sent to: Charles Fischer <cfischer at modernferrotype.com>
> To unsubscribe, send a blank message to trilug-leave at trilug.org from that
> address.
> TriLUG mailing list : http://www.trilug.org/mailman/listinfo/trilug
> Unsubscribe or edit options on the web  : http://www.trilug.org/mailman/
> options/trilug/cfischer%40modernferrotype.com
> Welcome to TriLUG: http://trilug.org/welcome