Although Microsoft has significantly improved Windows Defender, your system is still not immune to viruses. The worst case scenario is when a virus takes over your system and you can't start it. When this happens, you can use a live Linux distro to remove Windows viruses. This tutorial shows you how to remove Windows viruses using Linux.
Why do we use Linux?
If your Windows desktop refuses to Boot properly into safe mode If you want to explore the file system and boot your computer, you'll need a live environment. Sure, you can flash Windows to a USB drive and use its recovery command line, but your options are limited.
Flashing a USB drive with a Linux distro gives you several advantages, such as:
- A graphical environment to use on your system.
- Light Resource Profile
- Access to a package manager that allows you to install applications on the fly to a temporary space.
- The sandbox environment is not contaminated, affecting your Windows installation.
For most use cases, especially when removing infections that affect the file system, using a live Linux distro is the path of least resistance.
Note: If you've already booted your system with Linux and Windows, there's no need to use a live Linux USB drive. You can boot directly into your Linux OS and follow the steps below.
Which distribution should I use?
In most cases, Ubuntu offers a compelling choice, with a large repository, a graphical interface, and ease of use. For simplicity, many of the instructions in this tutorial will be relevant to Ubuntu.
Since we're using the native ClamAV for Linux to scan for viruses and other threats on your system, you can also use Arch and Fedora if you're more familiar with them.
Before proceeding further, flash your chosen distribution to a USB drive using a tool like balenaEtcher.
Running in Live OS
To properly boot from a USB drive, you'll need to configure your motherboard's BIOS to boot from a USB drive. Generally, you can access your BIOS by repeatedly pressing F1, F2, F10, F12, or Del. Once you're in, look for Introduction Or "boot order"Make sure the USB drive is at the top. If there is a boot option UEFI For the USB drive, also move it up, above any other options.
Allow the boot drive. You will be greeted by the GRUB screen, which allows you to choose from several options. Select “Try or install Ubuntu” And press Enter.
Once the USB drive has finished loading into memory, it will give you the option to try or install Ubuntu.
Choose Try Ubuntu , which should take you to your desktop.
Install ClamAV
- Click on Ctrl + Alt + T To unlock the device.
- Update Warehouses With a new release:
sudo apt update
- Installations ClamAV:
sudo apt install clamav
Now that you have ClamAV, it's time to use it to scan your system.
- Open files manager Yours. In Ubuntu , is a folder icon located on the dock on the left of the desktop.
- Click Other sites Near the bottom of the left sidebar.
- Select the Windows drive you want ClamAV to scan.
- Select your drive. If you have a large number of partitions, you'll know you've selected the correct one if the following folders are visible: Program files و "Users" و “Windows”.
- Right click on any empty space inside the file manager and click Open in TerminalThis provides a terminal window with the root folder of the drive already open.
- START YOUR ClamAV By order clamscan:
sudo clamscan -r .
This will scan the files in the current directory (the Windows root directory) repeatedly, looking for viruses along the way. The . represents This guide And the sign tells him -r To scan the entire folder tree repeatedly.
Using this command will perform a dry run. It will not remove any files. This lets you know which files ClamAV detects as viruses so you can decide for yourself whether to remove them.
7. At any time during the process, if you want to cancel the scan, simply press Ctrl + C on the keyboard.
8. If you want to ClamAV To remove files for you, swipe the option. –remove = yes As follows:
sudo clamscan -r . --remove=yes
9. If you don't want it to scan certain types of files, pass the –exclude= flag as many times as you need.
sudo clamscan -r . --remove=yes --exclude=.png
The above example excludes PNG image files, as they often don't have anything threatening written on them.
10. Add –verbose to this command if you want to see everything ClamAV does when you run it to scan. The infected flag might be more useful here, as it only lets you know when an infected file has been found.
11. Be aware that ClamAV will use a significant amount of system memory (I've recorded over 1.3GB of RAM usage) during the scanning process. Also, since it only uses one processing thread for the scanning process, it may take a long time to scan the entire drive.
After developing a proof-of-concept virus that simulated a worst-case scenario where Windows crashes, ClamAV was able to find and pinpoint the culprit within an hour. It was a lengthy process, but it seems this old-school antivirus still does its job very well.
Register
When performing a dry run (without the –remove flag), you may want to put the scan output into a file that you can search for later:
sudo clamscan -r . | tee ~/output.txt
This command tells ClamAV to perform a recursive scan of the current directory and output the result to a file. “output.txt” In the root directory of the USB drive.
You can later go to “output.txt” Search for the term “FOUND” To see every virus it detects. This helps you quickly find threats on your system without having to wade through miles of muddy terminal output after the fact!
Frequently Asked Questions
Q1: Does ClamAV use updated virus definitions?
The answer: Yes, when you install ClamAV, a service called clamav-freshclam is installed and started on your live system. This service keeps the heuristics database up to date for you.
Q2: Is there a GUI to use ClamAV?
The answer: You can install the clamtk package, which is a limited GUI front-end for ClamAV.
In Ubuntu, you can use the link in GitLab Developer Repository for Ubuntu/DebianOnce you download the .deb file, run it, and it should install ClamTK for you!
Q3: Can ClamAV be installed on Windows directly?
The answer: Yes. If you are able to run your Windows system, ClamAV has a Windows version that you can download from the developer's website.
