BleepingComputer.com: Questions About A Scanning Method?

Page 1 of 1

You cannot start a new topic
You cannot reply to this topic

Questions About A Scanning Method?

#1 image

Member

Group: Members
Posts: 21
Joined: 05-August 08

Posted 01 September 2008 - 03:05 PM

Curious to know if taking out an infected machines hard drive and scanning with another PC via USB/slave.
Would be a good way of starting a Malware removal process? Not stating it would be the only way I would scan Just as a initial scan.

#2 Galadriel

Bleepin Elf

Group: Malware Response Team
Posts: 2,715
Joined: 11-November 04
Gender:Female
Location:Missouri, USA

Posted 01 September 2008 - 03:11 PM

image, on Sep 1 2008, 03:05 PM, said:

Yes, it is indeed a good possibility. If the scanner has good detections, you could clean out all the infected files that way. But it wouldn't remove registry entries or any pointers to the files and if certain critical registry settings (like userinit/winlogon) have pointers to missing files, they can throw out errors and cause boot problems.

I cemna prestar aen. Han mathon ne nen. Han mathon ne chae. A han noston ne 'wilith. - Galadriel
'The avatar is changed; I can feel it in the water, I can feel it in the earth, I can smell it in the air.'
Phear teh ceiling cat, for he is roofkittehd! - Basement Cat

I'm a Bleeping Folder, are you? - Join BC in the fight against diseases - Click here
Become a BleepingComputer fan: Facebook

#3 image

Member

Group: Members
Posts: 21
Joined: 05-August 08

Posted 01 September 2008 - 03:15 PM

Oh ok then I could just through a Registry Scan after all the infections are gone. to fix those boot errors right?

#4 Galadriel

Bleepin Elf

Group: Malware Response Team
Posts: 2,715
Joined: 11-November 04
Gender:Female
Location:Missouri, USA

Posted 01 September 2008 - 03:30 PM

image, on Sep 1 2008, 03:15 PM, said:

Oh ok then I could just through a Registry Scan after all the infections are gone. to fix those boot errors right?

That depends on what would be the problem. Certain critical pointers will cause system to not boot. That's why it's best to use the main machine for cleanup unless you can't access it for some reason. There aren't very many ways to fix a registry when the system won't boot because of it.