ConsciousVibes.com

Home | Links ( Motorcycles, Computers )

Linux Antivirus For Windows

All of the information, instructions, and recommendations on this Web site are offered on a strictly "as is" basis. Remember "Murphy's Law." Please take the proper precautions before attempting any of the tips or modifications listed here.

Contents

How to use a Live Linux CD/DVD to scan a Windows PC for Viruses

• Knoppix Live Linux CD/DVD
• A live CD/DVD is optical media containing a complete, bootable, functioning, and operational operating system. It allows you to boot a system, from the Live CD/DVD, bypassing the OS on the hard disc drive.
• Knoppix automatically mounts Windows NTFS file system devices.
• F-PROT Antivirus for Linux Workstations
• The F-PROT virus signature files are supposed to have definitions that recognize both Linux and Windows malware.
• ImgBurn
• Used to burn the contents of the ISO to disc

Get the Knoppix Live Linux CD/DVD

• On a know clean system, download the Knoppix Live Linux CD / DVD ISO from knoppix.net
• Burn the Knoppix ISO to disc using ImgBurn

Boot the system from the Knoppix Live Linux CD/DVD

• The hard drives should show up as icons on the Desktop
• Download F-PROT Antivirus for Linux Workstation to the Desktop
  • Home page
• Right click on fp-Linux-i686-ws.tar.gz and select extract to here. This should create the f-prot directory on the Desktop.

Install and Update f-prot

• Open a root shell (look in Accessories in the main menu tree) or open a CLI
• Elevate your rights to root: su
• Change to the f-prot directory: cd /home/knoppix/Desktop/f-prot
  • Important! In Unix/Linux, file and directory names are case sensitive. So that's an uppercase "d" for Desktop.
• Install F-PROT Antivirus into RAMDisk: ./install-f-prot.pl
• The installation routine will try to update the virus signature files from the Internet.
• If you're behind a proxy server, the update will fail with an "Error: Network - Could not connect" message. You'll have to add the proxy server parameters to f-prot.conf
  • type: gedit f-prot.conf
• Add the proxy server information to the FPUPDATE_PROXY= variable.
  e.g. FPUPDATE_PROXY=proxy:8080
• Run the install routine again: ./install-f-prot.pl

Scan the hard drives for viruses

• Change the read/write mode of the hard drive so that f-prot can clean any malware it finds
  • Right click on the hard drive
  • Select "Change read/write mode"
  • Click the Yes button to allow read/write access to the hard drive
• Scan the hard drives: fpscan /<mountpoint>/<drive>
• e.g. fpscan /media/sda1 --disinfect --output=fpscan_report.txt
• To find out the <mount point> and <drive> of the hard drive, move the mouse pointer over the icon for the hard drive you want to scan. After a few seconds, the mount point and other information about the drive will be listed in a pop-up.
• Serial-ATA = sda1 and Parallel-ATA/EIDE = hda1

Reference

• Using Knoppix: Scan Windows NTFS for Viruses
• F-PROT Antivirus for Linux Workstations
• Doing Win NTFS scans from a Linux OS
• Knoppicillin
• Knoppix STD
• F-PROT Command Line Options