Hello friends,
There has to be a better way. I am desperately looking for a (way to create a) bootable antivirus CD that is update-able for Windows workstations that either won't boot into Windows (because of a virus) or else that cannot get a certain virus removed because it's running in memory even in safe mode (like some nasty DLL files). It's 2005--how come we still don't have this? That is, I know of ONE such thing, the Avast BART CD, but it is very expensive. Are there any others? I don't even want any of the fancy things like disk recovery tools but only a way to burn an updated antivirus CD (ISO file or whatever) that lets me scan harddisks without having to boot TO the harddisk. I know I can take harddisks out and put them as slaves into another computer and scan from there, but there has to be a better way. Any ideas? Thanks much.
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Hi Maritoboy......
With the major vendors, I'm sure the only thing you can do is to create a Rescue Disk.
I can try to help you to get rid of the virus that runs in Safe Mode
What virus is it ? Are you sure it's a Virus and not some malware instead ?
What virus scanner are you using and what spyware scanner ?
Thanks
Simon
Thanks for the help. I will take a look at the do-it-yourself CD, but I think this CD can only be used on your OWN machine and not on others (which is what I would need it for).
Simon-- I am asking about this in general, but I have lately had a problem that triggered my question. It is a virus that AVG's free Antivirus recognizes as a variant of the Startpage trojan. I forgot its exact name-- I think Startpage.J19 or something. Even booting into safe mode, it was impossible to get rid of the DLL file (se.dll)---either it was locked and couldn't be deleted, or else it could be deleted but would pop right back up again. What to do in such a case? I don't know why updated bootable antivirus disks are not yet on the market, at least not in a big way. And I don't think I want to spend 600 dollars for one year on the AVAST disc. I troubleshoot PC problems for home users and such a disc would come in real handy.
Ahhhh......I've got just the thing for you.....
Go to http://www.dee-it.com/down
Download the 30day free trial of Spysweeper, install it, update it and then scan.
Also, I assume you are running XP, if so you need to turn off system restore once you have installed Spysweeper.
This one is a clever little trojan and will hide in the System Restore folder and reappear, which is why you can't get rid of it.
Run Spysweeper and kill it off.
Reboot your machine in to Safe Mode and run Spysweeper again. It will kill it if it's there.
Reboot and then turn System Restore on again.
Hey presto, one clean PC !
Any probs, just drop me a line
Si
Hello all, thank you for your help. I didn't think of running Spysweeper, I could have done that. Not sure if it would have worked because I figured if the AVG can't get rid of it, why should Spysweeper? :) I had turned off System Restore, to my knowledge, and was working in Safe Mode, and still the file kept reappearing. This was about 2 weeks ago. Anyway, thanks for the advice. If I come across this problem again, I will do as suggested.
I guess I was mistaken on the BART CD being only for your own computer. I meant as regards compatibility, not regarding legal issues of licensing, though that's another important matter.
r-k, yes, I'd be interested to learn more about the "always locked or access denied" cases, that is, how to get rid of such files.
Thank you so much, all of you.
OK, here are the top three ways to get rid of those files that are somehow always "in use":
(1) Right-click on the file and select Properties -> Security -> Advanced, and un-check the box that reads "Inherit from parent the permission......" then click on "Remove" and OK, etc. This will remove all permissions for anyone to access that file.
Reboot, and the file will be rendered harmless. You will still need to track down the registry entries that were starting the file, but they will be ineffective now.
(Note: If using XP Home, you have to do the above after booting in Safe Mode, and if you don't see the Security tab in XP Pro, you have to un-check "Simple File Sharing" in Windows Explorer -> Tools -> Folder Options -> View)
(2) Boot from the BartPE CD, and use the A43 application to delete any files you want.
(3) Boot from the XP CD in "recovery console mode" and delete any files you want. If not sure how to enter the recovery console mode, see: http://www.wown.com/j_helm
The reason I like option (1) more than (2) or (3) is that often there are hard to find programs that use the offending file, so if you delete it, it might get re-created. With option (1), the file is still there on disk, but no one, not even the malware, can use it. After you have cleaned up the system enough, you can set the permissions back to give yourself delete permission, then delete the file as needed.
BTW, I highly recommend the BartPE CD for a variety of reasons, worth every penny!
By the way, I completely agree with r-k comments above.
AVG is not the best (in my opinion) Antivirus available as although it detects the virus, it doesn't clean it, it will only delete the file.
McAfee's Virusscan 8.0i has a far superior cleaning ability and would actually clean the virus to start with.
With antivirus, you do pay for what you get, but McAfee is still cheap
I only sell McAfee Antivirus as it's definitely the best in the business.......
Any more problems, just let us know !
Hello guys, here I am with a question about my newly created BART CD, of course. :)
I think I did everything according to the instructions and burned all the files from the local BART PE folder (C:\pebuilder313\BartPE) onto a CD, and though the BART CD works fine in Windows (I can even do a virus scan through the McAfee plugin), it does not boot up. I set my computer to boot from CD, and though the CD is accessed, it apparently finds nothing bootable in there and then proceeds to boot from the harddrive, that is, into my regular Windows. But the whole reason I wanted this BART CD in the first place is in order for the harddrive NOT to be accessed so that hard-to-delete viruses and files can be taken care of and do no run in memory. Any ideas? I did not see an ISO file in the root folder of my CD or the BART PE directory (C:\pebuilder313\BartPE), by the way.
Thanks!
Mario
From step (3) at http://www.nu2.nu/pebuilde
"At the main PE Builder dialog, enable the "Create ISO image".."
did you do this step?
Oh, good point. Well, I remember that I had a dilemma there -- of course I had my Windows CD in the drive so it could copy the files from there, and so of course I couldn't also put in a blank CD to write to at the same time. This is a laptop, so I don't have a second drive. Should I copy the Windows CD to my harddrive first and then have it pick up the files from there?
Mario
As I recall, what I did was to select "Create ISO Image", and un-check "Burn to CD".
This resulted in a file named pebuilder.iso getting created on the hard drive, which I later used to make a bootable CD. (I have Roxio, so if you have that also I can send details on how to make a CD from ISO image).
OK, guess what: I checked my Bart folder on the harddrive and there was the pebuilder.iso file, so I copied that onto my CD as the only file on it (I use a CD-RW while I'm trying to figure this out). But now the CD *still* won't boot! This is not my first time having a problem with an ISO image file not booting. I downloaded a trial for the AVAST BART CD and that doesn't boot either, though it's an ISO file. Unbelievable!
You can't just copy the iso file to your CD. You have to use a special option in your CD burning software to create a CD from the iso file.
For example, with Roxio v6 (which I have), I do the following:
Launch the Roxio front end -> Disc Creator Classic -> File -> Record Disc from Image..
etc.
If you can tell us which CD burning program you are using (Roxio, Nero etc?) and which version, we might be able to tell you exact sequence.
Also, I would highly recommend using CD-R media rather than RW for this purpose - much more stable and compatible with more drives.
With acknowledgements to r-k, here's a link on how to burn an ISO image:
http://iso.snoekonline.com
Hey, very good! Thank you. It worked! I used my NERO software to burn the ISO image and now it's working beautifully! This kind of CD is exactly what I needed. Two questions I have still, though: to update the antivirus, is there some easier way or do I have to burn a whole new image and CD every time? Secondly, what is the advantage of slipstreaming Service Pack 2 into this Bart CD -- will it have more or better features or something?
If I could, I would give you guys some extra points......
Mario
Business Accounts
Answer for Membership
by: leewPosted on 2005-07-27 at 17:57:36ID: 14542347
Have you tried making your own using BART PE?
http://www.nu2.nu/pebuilde