Is scanning a computer externally better.

[jonnyb]

Occasionally I get infected customer computers. Some won't boot or are very slow. Instead of fighting with getting it running to do a scan, is it better to pull the HD and scan it like it was an external drive with my fast desktop? Or is it better to get the OS working on the infected computer and scan that way so that the registry gets cleaned from the virus or spywares?

& will my computer get the infected HD cleaned completely as well as leaving it in the infected computer?

[HAN]

Scans from outside of Windows are excellent ways to find things like rootkits (that if running as the bad guys design them, are hidden beneath Windows. IOW, programs in Windows can't find/see them.)

You can remove the drive and scan it as you outlined or many AV makers make bootable CDs/bootable USBs Linux distros that can scan outside of Windows while the suspect drive is still in it's normal box.

Will it completely clean the affected PC? IMO, it's possible but far from guaranteed. I think a further manual checkup via a knowledgeable tech or something like the Intensive Care Unit here at VDr would still be in order.

[jonnyb]

The reason that I ask is just that some computers are slow to scan because of their processors, memory and old worn out Windows. My desktop is high speed and has a good fast copy of Windows that I keep running well so would scan the drive faster if I stuck it on my computer. I got an external dock that a drive fits into it like a small toaster. I just plug it in and start scanning.

I just thought if the scan was done on the computer with the bugs that it's registry would get changed along with the bug removal better than if done externally.

So which is better? It's own scan on it's own power or an external scan or does it even matter?

[jdc2000]

It really depends on the type of malware the infected drive contains. Rootkits can be easier to locate and remove with the drive slaved, but there can sometimes be registry entries that load hard to detect malware which might not be found with an external scan.

[jonnyb]

It really depends on the type of malware the infected drive contains. Rootkits can be easier to locate and remove with the drive slaved, but there can sometimes be registry entries that load hard to detect malware which might not be found with an external scan.

What you said here: " registry entries that load hard to detect malware" is a word salad to me and I don't understand it.

[jdc2000]

Link:

http://www.bleepingcomputer.com/tuto...tup-locations/

[SpywareDr]

Windows Sysinternals' "Autoruns for Windows" has the most comprehensive knowledge of auto-starting locations of any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys. You can configure Autoruns to show other locations, including Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more.