NWA-PCUG Newsletter Article, March 2009
VIPRE PC Rescue – New Free Malware Detector for Geeks
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

Iwilsker@apcug.net
(click to email author)

WEBSITES:
http://live.sunbeltsoftware.com

Last week in this column, I wrote about programs that I carry on a USB flash drive which I use to remove malware from infected computers. In the closing of that column I mentioned a new utility that I was going to experiment with, and which held great promise due to its pedigree. I have now had an opportunity to try this new, free utility, and its performance was impressive. This program, available for free download from live.sunbeltsoftware.com, is VIPRE PC Rescue from Sunbelt Software. The VIPRE PC Rescue Program may be more difficult to use than other malware detection and removal utilities, because it is intended for system administrators and other geeks that need a tool to revive a "dead' (or almost so) PC. According to Sunbelt Software, the software publisher, “The VIPRE Rescue Program is a command-line utility that will scan and clean an infected computer that is so bad off that (other) programs cannot be easily run.”

The program (68mb in size), is updated daily with new detection signature files, and can be downloaded to a computer or a USB flash drive, and then installed on the possibly infected computer by running the downloaded executable file, SBRescue.exe. Install it into the default directory selected by the program, and follow the onscreen prompts. When asked to unzip (uncompress) the files with the WinZip Self-Extractor, click on the Unzip button. After uncompressing and copying the files to the hard drive of the target computer, a batch file is automatically run in a CMD (DOS) window which will scan for rootkits and other malware on the computer, as it searches for any running malware among the processes on the computer. VIPRE then performs a detailed malware scan on the critical system files that are on the hard drive. This process may take several minutes, depending on the speed of the computer and the size of the hard drive.

If the computer cannot be booted into Windows, but can be booted into “Safe mode with command prompt” (F8), the software can be installed from the USB drive by navigating to its drive letter and typing "sbrescue" at the command prompt. Follow the on-screen prompts, and VIPRE PC Rescue will perform a quick scan. Once installed, the program can remain on the computer, and will not interfere with any other installed security software.

Once installed on the computer, additional quick or deep scans can be performed by using VIPRE PC Rescue as a command line scanner. To run a quick scan without much fuss, use Windows Explorer to navigate to the C:\SBRESCUE folder, and then click on the filename SBRescueScanner. The quick scan will then run in a DOS window.

To manually use the command line scanner which has more features, but does not run like a typical windows program, it must be run as a DOS program. Click on the START – RUN icons. Type “cmd” in the “run” box, and then click on OK to open the DOS window. Type “cd\sbrescue” (without the quotes) to navigate to the c:\sbrescue folder. Type SBRescueScanner along with any desired options. The command line options are: /boot, which registers the boot-time scanner (no scan performed until the computer is rebooted); /deep, which performs a deep (thorough) scan; /log, which enables verbose logging, and /norootkit, which disables the rootkit engine. If no command line option is selected, a quick scan without logging will be performed. If logging is enabled, results can be found in the C:\SBRESCUE directory in a .csv file. This file can be opened using Excel, Word or other viewer, but a spreadsheet such as Excel may provide a more readable file. It should be noted here that a deep scan examines the entire hard drive, and can take a substantial length of time, many times longer than a quick scan.

I ran a deep scan on my main computer, which is heavily protected, and routinely scanned with other utilities, and it took four hours to perform the complete scan. I was amazed that VIPRE PC Rescue found six “traces” of malware on my computer, which had gone undetected by the other scanners. I examined each item that had been placed in the SBRescue quarantine folder by the deep scan, and they were indeed traces, or fragments, of malware, none of which had been recently loaded into memory or otherwise run, but still represented a potential threat.

VIPRE PC Rescue requires that the computer be bootable, either into Windows or into safe mode. The publisher, Sunbelt Software, states that it is currently developing a version that can create a bootable CD, which can be used to attempt a scan on a badly infected computer that may not be bootable from the hard drive.

There are several other fine, and usually free malware detectors and removers available, such as the Malwarebytes Anti-Malware and “a-squared free” which run well on bootable and “live” computers, but this program, VIPRE PC Rescue, is, on the other hand, intended to be run on difficult or nearly dead computers that may have been crippled by malware. It is now my personal practice to use this program as my first choice if the computer is difficult to boot into Windows. I eagerly look forward to the next version which will be able to boot an otherwise unbootable computer from a CD, and then run the VIPRE PC Rescue program. This program would be a good choice to add to the users’ arsenal of anti-malware products, being sure to download a fresh, updated copy whenever possible. This product would be good for IT professionals, system administrators, computer repair professionals, and geeks who are comfortable with using a program with a command line interface. It may also be a good option for any experienced user who wants to try and recover an apparently dead PC that may be loaded with malware.

Click here to return to top



==================================================================