Malicious Mobile Code

Removing Viruses

The first step is the same for any computer virus, no matter what the type. After the first step, the type of virus determines subsequent steps.

Use an Antivirus Scanner

Always try using a commercial antivirus scanner to remove any virus. In some cases, like NTFS volumes, you may need to boot to the volume first, and then run the antivirus scanner. In Windows 2000, AVBOOT, is a good, no frills boot virus remover if kept up to date. Steps after this point assume you don’t have an antivirus scanner or it did not recognize and remove the virus.

Removing Boot Viruses

Removing most boot and MBR viruses involves many of the same steps as presented in Chapter 2. The hardest part in a Windows world is to determine what type of boot floppy you have to use to clean the virus and to restore the boot areas to their clean state. Each of the different Windows file systems, FAT, VFAT, FAT32, and NTFS, have their own boot files.

Boot with a clean disk

First, you need to boot with a known, clean, write-protected diskette that will recognize the disk partition. This means you can’t use a FAT32 boot disk on a FAT volume, or a FAT disk on a NTFS partition, and vice versa.

Tip

If the boot virus or the damage it can cause is unknown and your boot floppy gets you access to the disk partition, copy unbacked-up, crucial files to diskette. There is always a small chance that in the cleaning process, you could worsen the process further and make the partition inaccessible. If you cannot access ...