Easy USB Virus Scanning

Grant McMaster explains the USB approach to file recovery…
If you’ve ever had a machine compromised by a particularly virulent virus, impossible to remove malware or a rootkit, then chances are you’ve probably already had the joys of fruitlessly attempting to remove the suspect malware from your PC, followed by all the fun of a system wipe and clean OS install.
The problems with attempting to remove malware from within a running operating system lie in the fact that, as an infected system loads its own files into RAM, it also loads any infected files that have been placed there by the malware.
This is exactly how most malware is written to operate, especially so with rootkits, which are designed to hide themselves from security scanners within a system.
In addition to backing up important files regularly there are a couple of easy methods of protecting yourself against this kind of problem.
Ghosting or Cloning is a process that involves copying a drive for system, or data recovery. Norton Ghost is a popular piece of retail software to accomplish this, but there are free variants available such as Backup & Recovery 2014, AOMEI, Clonezilla and Macrium Reflect.
If you didn’t have the opportunity to ghost your system drive at installation then you have another option to recover your files and system.
Most modern PCs will boot from a USB drive and it’s also possible to install Windows or Linux to a USB drive and boot from there into a clean operating system.
If your system is corrupted, first open the case and disconnect the SATA power and Data connectors, then plug in your USB drive and place your Windows or Linux disk into the CD ROM.
Upon boot, select the USB drive and install Windows as you would to any other Hard Drive. When the installation is finished reboot your PC without reconnecting the infected drive.
After windows has started you can download and install antivirus software, such as Avast, spyware removal software such as Spybot – Search and Destroy and rootkit removal tools such as Bitdefender’s Rootkit Remover and Kaspersky’s TDSSKiller.
Once you have done this, turn off your PC and reconnect the system drive.
When you reboot, press whichever key takes you into your system BIOS or Boot Menu, this is the ‘Del’ and ‘F12’ keys on many systems. If you can’t get into your BIOS or boot menu then take a moment to search how to do so.
When you make it into your boot menu, ensure that you select the USB drive to boot from, this will give you a clean operating system running from your USB drive and with your system drive recognised but not active.
From this point you can set the antivirus and spyware scanners installed on the USB drive to scan your system drive. Without the system drive having been active as a boot drive you may have more success in removing malware.
It’s a good habit to keep a bootable USB drive or a ghosted system drive safe in case of emergencies, but above all, remember to back up important files regularly.
For more tips and support articles visit the VPS.NET knowledge base.