Ask Leo! by Leo A. Notenboom

How do I run an anti-virus scan if I can't boot?

Search First! Then browse: Categories | Full Archive | By Date | Newsletter

Home » Viruses and Malware

Summary: It's hard to run an anti-virus scan if you can't boot from the hard drive. To run an anti-virus or other scan, you'll need to take some special steps to boot from something else.

Most of the self-help books that have been written about XP say the same thing - if you can't start XP in safe mode you might have a virus so run an anti-virus program. Well, all of my anti-virus packages were downloaded, so I have no install disks. But even if I had an install disk, if I can't boot Windows, or I can't connect to the internet, a disk won't do me any good. So how do I run an anti-virus scan under these conditions? And if I reformat and reinstall XP, isn't there a possibility that a virus could attach itself to the new install if I haven't eliminated it beforehand?

You're experiencing a definite chicken-and-egg situation. You need to run an anti-virus program to possibly fix Windows, but you need to be able to run Windows in order to run the anti-virus program.

Seems like a no-win situation.

There are approaches, but they all revolve around booting something else.

When things are this broken, I often suggest just reinstalling Windows. If you do reformat and reinstall, you'll be erasing everything - including any viruses. If you rebuild the system in the correct order, you can stay safe from the beginning and be virus-free.

The problem is that this erases everything, including all your programs and data. If you've backed up properly, as you should, this shouldn't cause you too much grief. On the other hand, if you're like too many people, losing all that data may be a real problem.

So we'll look at a couple of options that don't involve a complete reformat.

Since you don't have install media for your anti-virus programs, you might consider purchasing one. Some may actually allow you to boot from their install media, and run an anti-virus scan right then and there. (Be sure to check before you purchase - I'm relatively certain this is an uncommon feature.

Another approach is to download (on another computer, of course) and burn to CD a stand-alone bootable operating system.

"... another approach is to use one of the Linux 'Live CDs'"

If you're technically adept, you can make your own bootable version of Windows using something called BartPE. Since Windows is not free you can't just download a copy - any copy - from the internet, legally. BartPE (Bart Preinstalled Environment) is a toolkit that allows you to create a bootable CD using the copy of the Windows CD you already own.

Many distributions of Linux, on the other hand, are free. Hence, another approach is to use one of the Linux "Live CDs". These are free, downloadable images that can be burned to CD. You can then boot from the CD and have a running version of Linux without having to make any changes to your system or hard disk. You can then run anti-virus software against the Windows installation on your hard disk.

The most popular Linux Live CD is Knoppix. This article from "Knoppix Hacks" describes using Knoppix to perform a Virus Scan.

Another promising Live CD is Ubuntu. Ubuntu's Live CD doubles as its install CD, should you ever want to switch.

The great thing about all of these bootable CDs is that once you do boot, even if you can't perform the virus scan, you can still examine your Windows hard disk and possibly repair problems by hand, or at least recover files before taking more drastic action.

Since I tend to be a computer geek, I have copies of both Knoppix and Ubuntu lying around. If you don't have an anti-virus program that you can boot from, my recommendation for most is to create or have someone help create a BartPE bootable disk, and then download or use the anti-virus software you're already familiar with.

There's one more approach that's worth looking into, and that's a repair install of Windows. You perform a repair install by booting from your Windows installation CD and selecting Repair Install when asked. The good news is that it doesn't erase everything, and may get you back to a point where you can boot your machine normally. The bad news is that it doesn't erase everything, so the viruses or spyware that got you to this point may still be lingering about. The approach to take is to use the repair install to get a bootable version of Windows, and then immediately run your anti-virus and anti-spyware scans. Possibly more than once.

Of course if the problem remains, you'll need to look into the other approaches already discussed.

Related:

  • How should I reinstall Windows? There are different ways to reinstall Windows. Which is appropriate depends on the problem you're attempting to solve.

  • How do I set up my computer - simply? If you don't want to spend a lot of time tweaking an elaborate setup, I present a basic, simpler, and quicker set of instructions to setup your computer.

Article C2726 - July 17, 2006

Helpful? Get new articles weekly by email in my FREE newsletter!

Your Name:
Your Email:


Why Subscribe?

Recent Comments
16 Comments

Here's a question, once upon a time I remember Nortons antivirus disk being bootable with a Dos scan and virus removal utility in it. does anything like that still exsits? and if so what company still makes it it was fantastic if you thought you were infected and couldn't boot. scanned EVERTYHING , you'd load your dat files a floppy after you booted to the CD and run it from there.

Posted by: Max Taylor at March 20, 2008 2:01 PM

Try to use Avast boot scan. It runs before Windows GUI is loaded. It is also free for non-commercial use. This is no advertisment :) I use it too in this situation. http://avast.com/

Posted by: chaleem at March 21, 2008 10:52 PM

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Another approach are to use the Linux "live" CDs like
Knoppix, or to build a Windows Boot CD yourself using a tool
like BartPE. Unfortunately a Windows boot CD cannot be
distributed (it's piracy of Windows), but you can make your
own using your own copy of Windows if you think to do so
before you have a problem.

Leo


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)

iD8DBQFH5unLCMEe9B/8oqERAvL9AJ9so++uWjKncsUdUYyY4EJ7tv3t/wCbBCQu
nIb894jJdsuliQ3nQhg5m8I=
=dUmk
-----END PGP SIGNATURE-----

Posted by: Leo A. Notenboom at March 23, 2008 4:37 PM

Very interesting but difficult for a non-expert: I tried to implement using.
1. BartPe. Created a cd but couldn't implement an antivirus plugin. The documentation doesn't seem to be up to date. Do you have a working example?

2. I have a Ubuntu live CD but it doesn't include an antivirus scanner. Can't download one as Ubuntu live won't store to the hard disk.

3. Chaleem suggested doing an Avast boot scan. I use the free Avast version but it doesn't include the boot scan.

4. re Max Taylor's note I have an old Norton Systemworks cd and it does a boot scan but only of the a drive!

Posted by: gadya at December 11, 2008 10:24 AM

my emachine winxp he just went to a black screen oneday that said boot failure insert system disk and press any key. i do not have a sys disk just the two disks that came with my pc. i tried different things that i saw on these forums and am now at NTDLR MISSING i can get into my boot menu and my bios setting but thats all i cant get into windows any help out there please. ty

Posted by: jan at April 1, 2009 2:47 PM

My Grandparents computer is bogged down will not bring up Icons or windows bar at the bottom is trying to get them to purchase protection before they can user there computer afain could not find safe MODE ....ANY IDEAS??

Sounds bad. Without knowing more specifics, all I can recommend is this: How do I remove a virus? - though it sounds like a reformat/reinstall is in your future.
Leo
24-Aug-2009

Posted by: Phillip at August 23, 2009 11:55 AM

Hello.
New here, just signed up this morning.
Tried to go to the following:
"using Knoppix to perform a Virus Scan" http://go.ask-leo.com/060717a.
Get redirected to:
http://blog.makezine.com/archive/hacks/.
Nothing there I can use to do a virus scan.
Help.
Thanks,
Fred.

Posted by: Fred at September 21, 2009 7:41 AM

Norton does still have bootable disks for system recovery. It comes free with yor NIS. If you don't know where to get yours, you can ask Norton Support and they will provide the download url. You will need your Norton Product Key to run the virus scan.

Posted by: jeh_it at September 30, 2009 4:01 PM

I have the same problem as the others. XP operating system, with SP2, on a computer maybe 5+ years old. Plenty of anti-virus software. Computer started rebooting itself for no known reason last week. Tried Repairing it several times but it kept rebooting itself every time it got into Windows. The time spent in Windows got shorter and shorter until I couldn't even get into the OS. Just a black and white text screen, wouldn't even get past the boot menu - the computer froze every time.
I created a Knoppix (Linux) bootable CD as suggested. Put it into the CD drive... turned it on... CD booted up... got the splash screen... got a message that it was loading Linux... and then everything went black and the CD stopped spinning. Dead to the world.
And somehow when the bad computer rebooted itself, another computer which was plugged into the same router also rebooted itself over and over and over and over and over...
Two computers dead. How can it pass through a router?
Any and all suggestions to help fix these electronic paperweights would be GREATLY appreciated.

Posted by: iggy at October 11, 2009 1:16 AM

My computer did the exact same thing as Iggy's. I have a router is my iPod that runs on the same network in any danger?

Posted by: Sierra at October 17, 2009 6:40 PM

Post a comment on "How do I run an anti-virus scan if I can't boot?":






(Email Address will not be published.)

Remember Me?

By popular demand...
my tip jar
Cuppa Joe
Buy Leo a Latte!

(you may use HTML tags for style)

RSS feed Subscribe to the RSS Feed specifically for comments on this article.

Before commenting, please...

  • Read the article at the top of this page. If your comment shows you didn't, it'll be deleted and ignored.

  • Comment only on this article. Use the Google search box at the top of the page if you have a question about something else.

  • Don't include personal information in the comment. No email addresses. No phone numbers. No physical addresses.

  • Don't spam. Excessive links to unrelated sites within a comment or across multiple comments will cause all such comments to be removed.

  • Don't ask me to recover lost passwords or hacked accounts. I can't, and those comments will be deleted.

  • I can't respond to every comment. And I can't vouch for the accuracy of others who do.

Please wait. Your comment is being processed ...


Question? Ask Leo!