> I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything. Working directly on Windows is impossible

I don't think that would be all that useful. If you have a malware-infected system then your focus should be rescuing user data, and not cleaning the infection (which is pretty much impossible to do reliably).

> your focus should be rescuing user data

Good luck figuring out if the user data is the cause of further infections. Add some infected pdf, tif, jpg files and it could come right back. In the terms of less common applications there are likely thousands of libraries used by these programs with data interpretation exploits waiting to be be found.

>I'm thinking someone should build a (Linux or other *IX) that scans the HD of an infected machine (booted with this distro or the HD was removed and put on another machine) to scan and remove everything.

Kaspersky did it.

http://support.kaspersky.com/viruses/rescuedisk

Also bitdefender: http://download.bitdefender.com/rescue_cd/2013/

and AVG: http://www.avg.com/us-en/download.prd-arl

although I am not sure if they are linux based.

They are. I've used the kaspersky and AGV live disks. It's nice because you boot up and you can download new definitions without something hogging your bandwidth and clicking through a bunch of popups or what ever.

Also Sophos

http://www.sophos.com/en-us/products/free-tools/virus-remova...

Trinity Resource Kit: http://trinityhome.org/Home/index.php?wpid=1&front_id=12

Among other things, it boots a live linux CD that's packaged with a handful of 3-5 antivirus scanners.

I was going to suggest Chocolate -- it's like Homebrew for PowerShell, but it doesn't always install things where you want it to. And as it turns out, PuTTY might not be maintained as much as it once was -- or that's the rumour.

I was shocked by how many forks of PuTTY there are -- and most suck: https://github.com/FauxFaux/PuTTYTray/wiki/Other-forks-of-Pu...

Many recommend KiTTY but with an ad supported site that complains about adblock when you go SSL (after a warning) and includes hidden features -- well, that's not something I'd trust either.

My day-to-day dealing with Windows being very limited, I find this interesting. Is it your impression that the security features introduced since Vista have been ineffective and only taught naive users to always click the "yes" button?

My experience in a tier 1 tech support job is:

     1. The user clicks yes. They might read what they clicked yes to.
     2. The user doesn't usually read prompts
     3. The user will not read error messages, even if they are to their benefit.
     4. The user doesn't know how to "google" problems
     5. The user will sometimes even ignore IT professional help even when they call us. This is usually a "bitch session" with no clear resolution.
     6. You will tell the user what to do, and they will also say yes. They still don't understand.
     7. Users will install software and not understand how to remove said software (control panel<remove software).
     8. Users are not curious. What would be obvious to simple reading they will ignore.
     9. Only when the computing environment is unbearable, will they call in. Or it will be the simpleton user who wants you to do their work for them.

Only because that's traditionally where the users have been. If everybody switched to desktop linux, the malware would target linux instead.

Linux doesn't have a tradition of downloading and installing random software, though, so there would be a bigger behavioral hurdle to get users to install the malware.

I think the behavioral differences are almost entirely because current Linux userbase is mostly people who have self-selected Linux over the default OS their laptop came with.

(And I still see a fair number of Linux install scripts that look like "curl ... | sh")

Linux has a nice repository, with nearly all the software you need available, signed with known good keys.

Linux does not have "your mouse pointer moved. Are you sure you want to proceed?" dialogs.

Linux has a manageable set of file permissions, including the "execute" permission being set by the users, not by any random server from where you download your file. (Yep, there was some regression here lately.)

And, of course, Linux is actually hard to compromise without user intervention. Differently from Windows.

If you really believe it's the users fault, you have your head deep buried on the sand.

No it can be worse than that the install instructions say:

  `curl http://example.com/foo/install.sh | sudo sh`

or if it does request the script by https there is a fair chance that the install script itself will then download by http.

Equally bad is adding a new key to apt/(other package manager) and add a new source then apt-get install (which definitely runs as root).

I blame that on overconfident MacOS X developers not understanding best practices for security.

The tradition was there, and it sucked.

Hunting the Internet to track down random dependencies, watching freshmeat.net every day for new releases, and fighting with all of the different build systems was what I did every day ca. 1997.

Yeah. The key word here is "was".

In other words, installing (and upgrading!) software in Windows has not made much progress since 1997. I blame MS's decision "oh sure, you can integrate your program into Windows Update, it will only cost you $BigBucks per year."

No, you just have to install from source if you want something that your package manager doesn't provide and then hope you can actually get all the dependencies compiled.

Windows is such an open door (NPI) its incredible. Stupidly trivial malware can rewrite desktop icon shortcuts to append some url so the browser will start on it. I spent hours trying to help a neighbor before stumbling on this 'hack'.

i'm only familiar with f-secure but imagine any av vendor would have something like this(but yea, what if system files were infected?)? https://www.f-secure.com/en/web/labs_global/removal-tools/-/...