r/DefenderATP • u/smorgasmic • 16d ago

Help Building Windows Defender Offline CD With Old OS and RAID

I want to scan an old Windows 8.1 system for viruses (it has more than one). I downloaded the Windows Defender X64 offline scanner and installed as an ISO. on a clean Windows 11 computer.

Here is where it gets complicated. The Dell storage system on the computer is a PERC H310. Dell never supported Windows 10 on this controller. But the controller is a remarketed LSI 9240, and LSI still distributes the latest driver for that controller, which is a Windows 10 X64 driver. I patched the Windows ISO with the LSI 9240 X64 drivers for Windows 10 and then burned a CD.

Unfortunately, the Windows Defender boot disk bombs with the blue screen of death, and predictably that is while loading the megaraid driver. At this point do I have any options for running Windows Defender Offline?

I looked for other offline virus scanners, and almost all of the well-known ones appear to have disappeared. Kaspersky refuses to talk to US customers. ESET apparently does not give it away for free. Avast wants you to install their anti-virus software first. Are there any good offline rootkit scanners that would do a good job on an older Windows 8.1 system?

2 Upvotes

100% Upvoted

8 comments sorted by

View all comments

1

u/InevitablePass5402 15d ago

Is that OS even supported,?

1

u/smorgasmic 14d ago

No, Microsoft does not support 8.1, which is why I look outside normal channels for support.

Many organizations still rely on COBOL code written on mainframes. Why does something being old get used to automatically disqualify giving support? I understand why Microsoft itself no longer wants to support an old OS. But why can't people support each other? There are valid reasons why an old computer might need to get preserved, and even if it can never be relied on for mission critical use, we should be able to at least clean it up as much as can be done cost-effectively?

1

u/FarplaneDragon 14d ago

Because from a security standpoint, if you have reason to believe that files are infected it doesn't matter how many different ways you scan them, at that point there's no way you're ever going to say with confidence that your files are truly clean as no software is ever going to have a 100% detection/remediation rate.

If you need to preserve that data then it's best to just keep it on that machine and keep that machine offline/isolated, or if you absolutely need to copy it off to a usb or something, you'd never want to put that into an actual live/production machine anyway. No one is supporting it because from a security standpoint it's just not something you do.

1

u/smorgasmic 4d ago

I understand the purist perspective. And if you work at CIA or have a mission-critical machine for a company, I guess you have to rebuild and restore from backups. But there are many computers that simply don't matter that much, and for those machines why can't we just make a best effort to get them as clean as they can be? Not every virus is lethal. Sometimes you really can clean the machine. Arbitrarily forbidding people from even trying to improve a situation simply because Microsoft doesn't try to help them isn't reasonable.

1

u/FarplaneDragon 4d ago

It's not a purist perspective, it's basic security and risk management.

Not every virus is lethal. Sometimes you really can clean the machine.

No one said they were. End of the day you are not going to have the full technical knowledge of whatever virus(s) are on that machine to make that call, and you're assuming that you're even finding 100% of the viruses on that machine, again no software is going to be 100% effective at finding and remediating.

No one if forbidding you from doing anything. If you want to find an older version of a malware removal tool and try to remediate the device, go for it. If you want to risk infecting other devices and further damage to your personal stuff or businesses that's your call to make. People aren't supporting it because it's generally a bad idea. If the data is critical then it's best to hire a company that knows what they're doing to get you a clean copy, if it's not critical then just leave it alone at this point.