ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Microsoft ships free malware cleaner that boots from CD or USB

By | June 1, 2011, 10:15am PDT

Summary: In a move aimed at cutting down on support call costs, Microsoft has released a malware recovery tool that boots from a CD or USB stick.

In a move aimed at cutting down on support call costs, Microsoft has released a malware recovery tool that boots from a CD or USB stick.

The tool, currently in beta, is called Microsoft Standalone System Sweeper, and promises to help start an infected PC and perform an offline scan to help identify and remove rootkits and other advanced malware.

In addition, Microsoft says the System Sweeper utility can be used if you cannot install or start an antivirus solution on your PC, or if the installed solution can’t detect or remove malware on your PC.

The company made it clear that the recovery tool is not a replacement for a full antivirus product.follow Ryan Naraine on twitter

It is available for both 32-but and 64-bit Windows systems and uses the same antivirus engine as the Microsoft Security Essentials product.

Just last month, the company shipped a free security tool called  Microsoft Safety Scanner to offer on-demand scanning to helps remove viruses, spyware, and other malicious software. The safety scanner works with existing antivirus software.

These utilities are a big part in helping Microsoft to cut down on support costs stemming from malware infections.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
72
Comments

Join the conversation!

Just In

RE: Microsoft ships free malware cleaner that boots from CD or USB
arthur.freed 22nd Sep
At least they have the initiative to do it but why now? Free is good and with new malwares, viruses and etc. coming out today I think it is not enough. Microsoft would at least be in tune with what is present, most importantly to there consumers.

Mortgage Tampa Florida
Mortgage Jacksonville FL

Keyword Research
0 Votes
+ -
Timing
apophys@... 1st Jun
Only 10-15 years too late.
0 Votes
+ -
@apophys@...

Not really. I'd say at least 5. Could have used this during the XP days, when Windows was really being slammed with malware.
@Cylon Centurion

Agreed.

Better late than never, but good all the same to see Microsoft protecting the OS they create. (If anyone knows how to protect Windows, they do. They create it after all!)

Will be keeping an eye on that one.
Better late than never, but good all the same to see Microsoft protecting the OS they create. (If anyone knows how to protect Windows, they do. They create it after all!)

They have no choice. Unless they want another lawsuit.
  • Flagged
@Cylon Centurion Hmmmm... my Win 7 system is getting slammed much more than my XP system ever did.

Just sayin'.
@csteinola

You shouldn't be. I'd take a good look at your browsing habits if you keep getting "slammed".
@Cylon Centurion Operative word "was"? If it isn't being slammed now why would anyone develop or need this tool?
0 Votes
+ -
@apophys@...
The whole DoJ thing, you know.
0 Votes
+ -
This is a great move on Microsoft's part, not just for the safety of Windows users, but very smart from a PR standpoint.

Apple could stand to learn a thing or two about proactively fighting malware and allaying customers' fear and concerns. Their whole ostrich act of late (over Mac Defender) really drives home this point.
@BGunnells
Yes, it is an excellent move on MS's part. I know the reasons behind it are strictly bottom-line customer-keeping/getting ploys, but t's stll good. NOT good enough to abate my hate for their past actons or to go back to them in any way. They'll have to do a lot more for me than that, plus lower their costs.
If the microsoft ESSENTIALS didn't stop the infection then HOW is this tool going to find it? Just another bogus thing to put the companies that have this working already out of business.
@domma

You really do not know how these things work do you? Typically today the infections come in after the user has given the OK to install some fake software that basically disables any installed protection and even blocks the installed applications and services from running.

This runs independently and outside the OS so it cannot be stopped by that software that the user acknowledged and installed that disabled their protection. Think of it this way. A homeowner gets allows a burgler into the home and gets robbed and held hostage and it requires the police to intervene from the outside. Even their all in one Safety Scanner that runs in Windows will do a good job as it requires no services and nothing to be installed. However I find that you may have to rename the executable for some malware infections.
At least they have the initiative to do it but why now? Free is good and with new malwares, viruses and etc. coming out today I think it is not enough. Microsoft would at least be in tune with what is present, most importantly to there consumers.

Mortgage Tampa Florida
Mortgage Jacksonville FL

Keyword Research
About time! I'll have to give it a try. My arsenal typically includes an Ultimate Boot CD for Win (UBCD). Maybe this will provide some easier tools!
Thanks for the article,
David
http://HiTechBrew.com
@DavidShepherd

Keep that UBCD4Win handy. The Security Sweeper expires 10 days after download (to keep the virus defs relatively up to date) and you have to re-download.

Whoops. I stand corrected. It's the Safety Scanner you have to re-download every 10 days.
@lshanahan Beta ... like a Google product... it's a beta. Lost ball dude
@DavidShepherd

Isn't UBCD geared towards XP? A dying OS?
@blind obedience
Not at all, any OS system.
@blind obedience
XP is supported thru 2014 believe it is. And many people are going to skip win 7, the built-on-Vsta crap with a lot of user frendliness problems and problem names for their apps.
XP wll be around for a long time yet; the only impetus win7 has is due to contracts which force dealers to provide it and not XP. They're working toward forced obsoletion agaiin - it's only MS that needs the new Vista (win 7) so badly.
@tom@...

Many people are skipping Windows 7? I'd take a look again at it's market share.
@daikon
I go to the website and only XP is mentioned. Even the screen shots are of XP.

Looks like the UBCD website (and possibly the program itself) needs an upgrade. Big time.
its boot kernel is XP that is it. the scanning tools and other applications are why it exists not its kernel.
Sweet. Bookmarked for future reference.
0 Votes
+ -
Message has been deleted.
Cylon Centurion Updated - 1st Jun
0 Votes
+ -
Message has been deleted.
vlada.mv Updated - 1st Jun
0 Votes
+ -
I say kudos, better late than never.
BobsYourUnclw 1st Jun
There are a lot of customers and consumers out there that need this, and yes, it might be long overdue but kudos for taking the step go to MS.
@BobsYourUnclw... YES! if it works and actually finds AND removes the offending malware.
This is already available as part of DaRT (which is part of MDOP), and has been for a long time. However, issuing it as a public release is new. Previously, you'd have to have Software Assurance for Windows client licenses to get access to MDOP.
@Joe_Raby
Which makes it beta for public release???
0 Votes
+ -
Message has been deleted.
LoverockDavidson Updated - 1st Jun
@LoverockDavidson

It works well. Used it once already. I had to do a couple supplemental scans to clean up some residue left behind but it fixed the machine and the damage.
This is great that Microsoft provides this tool instead of denying the malware exists, then acknowledging it but insisting on not helping like we've been reading about so much lately.
@LoverockDavidson Nice response- you didn't even have to name 'the great one who lives in denial'! Fantastic!
Microsoft seems to be taking a very serious stance against malware offering FREE and effective utilities to help prevent and remove Viruses and Malware on top of a FREE support hotline for assistance. It took them a bit longer than it should have to wake up but I am glad that they finally did.

Now only if we could get the computer operators to wake up and take steps to secure themselves and their technology.
@bobiroc

(sarcasm)

How about gluing their fingers together!!!!

(/sarcasm)

You and I both know that most problems are due to user stupidity. (e.g. "You need to download this codec to view a video of .....)
@fatman65535

I was thinking something more along the lines of electrified keyboards and mice. Zap them when they attempt to do something potentially dangerous.
Seriously, Vista and Windows 7 have SO MANY virus protections that it's almost impossible to get a serious, irremovable virus on it.

Unless, of course, you are downloading Keygen programs for various things on the internet. Those are usually virus infested unless they come from very well known 'scene' people
@Lerianis10

I would like to know this as well. Simply put, you shouldn't be seeing malware on your systems at all, unless the user is simply clikcing through the warnings.
0 Votes
+ -
32-but and 64-bit
SaintCav 1st Jun
Can I get the 32-but version please?

"It is available for both 32-but and 64-bit Windows systems and uses the same antivirus engine as the Microsoft Security Essentials product."
naw . not 10 years late we always had the refromatt options and recovery options ..well Apple Malware problem just turned into new Market for computer repairs one door closes one door opens that is how it works grin
Well as we waste time with computers it will only get worse.

Abandon technology, computers and software --no good will come of it.
how do I get this tool?
Vista Total Security 2011 just did a number on my daughter's PC. I gave her my mac. My malware cleaner was Ubuntu, which installed Ubuntu over the all-but-dead Vista (MBR f8xxored, rootkitted beyond saving by any of my AVs). Happier that way than with a restored Vista I have to say.
@garylhewitt
Avira Rescue System (bootable CD) has brought a PC or two back from the brink for me? But sometimes the malware gets so deep that when it's removed, things don't work exactly like they used to :\
@garylhewitt If it was that badly compromised, I don't think it was just Vista Total Security 2011. All of those Fake AV trojans have been very easy to remove.
Since I've had Microsoft's own antivirus and several others (McAfee, Symantec, AVG, etc.) all broken / disabled with viruses in the past; this is beyond welcome news assuming it works.
0 Votes
+ -
This is something that should have been out since Win3.1. You cannot run some programs inside winders no matter what. An imager for example (Hear that Synamptic???) and a malware cleaner are two /great/ examples..

What I hope it does, is bypass AND stop MS's stupid idea of replacing files it found to be erased automatically. You could rip out any malware if it couldn't be replaced, and also it's not running in Windows.

I've used SystemRescueCD for years (and it was my first tastes of linux) and it worked far superior than anything on the market. partimage? Worked just fine to @image Windows and keep from having to reinstall it time again again. Been nice if MS gave us a basic imager /years ago/. This CD also allows me to copy files off the HD even if winders can't start, saved a lot of my clients bacon.

Yes, MS is very late to the game, but at least they're trying. Maybe it's a turn for the better.

Yeah, and horses fly, did you know that?
- Kc
@kcredden2
You are what I call a "natural born whiner".
Have a nice day happy
0 Votes
+ -
Could be useful
ScorpioBlue 2nd Jun
As long as it's free and MS doesn't require you to have spyware garbage like WGA installed in order to run it.
0 Votes
+ -
Nice tool
MrElectrifyer 2nd Jun
Keeping a bookmark of it just incase I ever come to needing it in the future; better safe than sorry happy

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix