Baslinux mailing list

[baslinux AT lists.ibiblio.org]

Sindi Keesan

On Thu, 5 Mar 2009, baslinux AT lists.ibiblio.org wrote:

> Can I insert some module (2.4 or even 2.6 kernel) that will let me delete
> as well as read NTFS files?  I am trying to remove a virus from someone's
> XP laptop.  It spreads via USB flash drives and I can easily claen it off
> the FAT16 drive with BL, but DSL and Knoppix live CDs mount NTFS only
> read-only.
>
> Is there some live linux CD that mounts NTFS not just read only?  If so I
> could copy the kernel and module from that.
>
> The blasted laptop is hijacked somehow so I cannot even download antivirus
> programs to it (except via USB drive which then gets infected).

CDlinux 0.9.2 mini (console only) rescue CD with busybox 1.13 and a recent 
kernel includes fuse module and ntfs-3g program needed to write to NTFS. 
I booted in automount mode, deleted two exe files, and all the restore 
points, and then deleted two registry entries pointing to these files, in 
WIndows.  The virus was disabling task manager and regedit and copying 
itself to my USB flash drive.  Antivir, Malwarebytes and Superantispyware 
missed it (today's downloads).  Linux to the rescue.

BL was not designed to battle with WIndows.  The rescue CD also has 
cabextract.  The module and binary need later kernel and libraries.

A 1-floppy BL would have fixed this if FAT32.