When scanning in Dos was the only way to clean.

I was called to a computer running Windows Me (Multiple Errors) who had not used an AV program for years.

It was infected with w95.dupator.1503.A

The dupator virus infected the kernel32.dll (it runs & loads windows), which infects all exe's at startup, so when I installed Nod 32, it too was infected.
This caused safemode only access to windows. I uninstalled it in safemode and then did the
following.

On a clean computer, I downloaded the dos version of Nod32 and unpacked it. I copied the unpacked nod32dos version files straight onto a cd which made it write protected.
I didn't know how to make a bootable cd, this would have started automatically, scanning in dos before windows was operating.

Anyway... with the resumed infected Windows running, I then copied these files from the cd onto the c:\ and they were still read only. I restarted the computer with a startup floppy disc and changed drives from A to C and ran c:\nod32dos.exe.

It worked, and cleaned the kernel32.dll, this then allowed me to install Nod32 for windows finally uninfected.

I have since made a suggestion that scanning from a floppy should be a part of Nod32's FAQ's, and that creating the discs should be considered part of the installation process. Nod32dos will not fit on one floppy.

However... With most new computers being made without floppy drives, Nod needs to prepare clients for scanning outside of Windows and the making of bootable cd roms loaded to scan in dos.

I hope this may help someone with a similar problem.

 

But, how about windows in NTFS partition. Antivirus for dos version only can read FAT32 partition. Is there any way to scan virus on NTFS partition with dos version?