NWA-PCUG Newsletter Article, June 2010
Remove Resistant Malware
Free With Bootable CDs

By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host
iwilsker@apcug.net
(click to email author)

WEBSITES:
http://download.bitdefender.com/rescue_cd
http://www.free-av.com/en/tools/12/avira_antivir_rescue_system.html
http://www.f-secure.com/en_EMEA/security/tools/rescue-cd/

In some recent columns I wrote about several free utilities that can be used to remove malware from most infected computers. Those utilities either had to be loaded and run on the infected computer (such as Malwarebytes) or run from a USB flash drive (a-squared free USB stick files and SUPERAntispyware Portable version). While those excellent utilities were very capable of removing almost all infections from a contaminated computer, there are some computers that are so badly infested with malware, spyware, viruses, and trojans that either nothing could be run on those computers, or, in a few cases, the computer would not even boot. I have had users with badly infected on unbootable computers who were going to either reformat their hard drives (with the resultant loss of all of their data and files), or trash their otherwise good computers and purchase a new one.

Prior to taking such drastic actions, the user still has another choice to kill the malware and retake control of his computer at little or no expense. Several of the security software companies offer free software that can create a bootable CD complete with software that can detect and kill the malware, and possibly repair the computer to a bootable condition. As a matter of practice, if this bootable CD process is successful, I routinely run two other malware killers on the newly booted computer to verify that the computer is indeed clean of malware.

The well respected security company BitDefender offers a comprehensive free antimalware scanner "BitDefender Rescue CD " that is intended to be burned to a CD. This utility, which is in the ISO format, can be downloaded from download.bitdefender.com/rescue_cd. In addition to the ISO file, there are two PDF files "HowTo.PDF" and BD_Rescue_CD.PDF" that should be opened, as they contain detailed instructions on how to properly burn the ISO file to a CD (it is not simply copied to a CD, but must be burned as an ISO image), and when to use the many utilities that will be on the bootable CD. Since the infected computer may not be capable of downloading and burning the CD, this step should be performed on another clean computer. Since the CD is in the Knoppix operating system (a cousin of the Linux OS), the user will need to precisely follow the instructions on the PDF files in order to disinfect the computer, and recover the Windows files. Since the CD is not in the Windows computer language, the malware on the computer will be incapable of executing or otherwise interfering with the BitDefender Rescue CD. The antivirus signatures used on the Rescue CD are updated automatically each time the CD is loaded.

Once the computer is booted from the BitDefender Rescue CD, a dark red desktop will appear with icons representing the several functions available, including the Firefox browser, and an icon to update the antivirus signatures. The logical icon to start the recovery process is appropriately labeled "Start Here". As a safety precaution, the Rescue CD offers the ability to open the drives on the infected computer allowing for critical data files to be copied to a USB flash drive or similar device. Since the operating system running is not Windows, the drive on the computer will not have the familiar "C:" designation, but more likely a designation something like "sda1". Despite the difference in the drive name, files can be copied from the hard drive to the USB drive just as they are when booted into Windows.

Once the Bit Defender Rescue CD has completed its malware scan and removed the detected malware, the CD should be closed according to the directions in the manual, removed from the CD drive, and then the computer rebooted into Windows. Once Windows successfully boots, it would be a good idea to use one or two other free utilities, such as Malwarebytes, a-squared free, or SUPERAntispyware to confirm that the computer is indeed clean of infection. Another point to remember is that it will likely be necessary to reinstall any antivirus software or security suite that was on the computer, as much of the malware in circulation destroys the protective software that may be on the computer. I always have a BitDefender Rescue CD in my car, and take it with me if there is a sick computer that may need rescuing. I have used this CD several times with a high degree of success, and can recommend it to anyone who may need to rescue a badly infected PC.

One of the most popular free utilities that can create a bootable CD is Avira AntiVir Rescue System. This utility, which is maintained and updated several times a day by one of the top rated security companies, when downloaded and executed, will create a bootable CD or DVD containing software that can scan the system for malware, repair system damage, and likely rescue the data on the computer. Since the infected computer may not be in running condition, this software should be downloaded on a clean computer and burned to CD or DVD from that computer, and then used to boot the infected computer. While the software installed to the CD is in the Linux operating system, which is bootable on a Windows machine, all of the utilities on the CD will be capable of reading and repairing a Windows system. Since the software on the Avira website is updated several times a day, a fresh copy should be downloaded and burned to CD each time it is to be used.

While not as capable and up to date as the other products, F-Secure offers a free Rescue CD at http://www.f-secure.com/en_EMEA/security/tools/rescue-cd. Both the software to be burned to CD and an instruction manual, "Rescue CD Users Guide (PDF)" is available from this location. The users' guide contains detailed but easy to follow instructions on how to use the bootable CD. As with the other bootable CDs, the F-Secure Rescue CD is bootable (in Knoppix) and contains several utilities that may be able to recover a Windows computer that is not bootable. This Rescue CD will scan the computer, and quarantine any malware that it detects; sometimes this is all that is necessary to allow the computer to boot into Windows. This CD also allows the user to copy any desired files to a USB drive for backup purposes, a necessary function in case the Windows is so badly damaged that it is still not bootable into Windows.

It is not necessary to be a geek in order to use any of the above utilities to create a bootable CD and recover an infected computer, but it may take some time and the ability to follow the instructions in the PDF manuals. If a computer is heavily infested with malware, or otherwise will not boot, it may be well worth the time and effort to try one or more of these rescue and recovery CD utilities. Blank CDs are cheap, and the time and effort to recover the damaged computer may well be worth the endeavor.

Click here to return to top



==================================================================