This is how you scan Windows systems with Disinfect

A new feature in the open-source malware scanner Desinfec't allows users to scan Windows systems over a network, addressing several limitations of the current version. The update enables scanning without booting from external media, which previously posed challenges due to hardware compatibility, secure boot settings, and encryption protocols. This change makes the tool more accessible to a broader range of users, including those with limited technical expertise or constrained system resources. The development comes after discussions among developers about improving the usability of Desinfec't on Windows platforms. Initially, the software required booting from a USB stick, which created barriers for some users. The new network-based approach eliminates this requirement by allowing scans to run directly on a Windows machine. Instead of relying on external storage devices, the updated method uses shadow copies, snapshots of file systems, to create virtual block devices accessible over the network. This technique bypasses many of the obstacles associated with direct disk access, such as dynamic volumes and encrypted drives. To implement the feature, the team developed a compact application that runs on a Windows host. It generates a shadow copy of a Windows NTFS volume and exposes it as a network-accessible block device. Another instance of Desinfec't, running on a different computer within the same network, can then access these virtual drives as if they were local storage. This setup avoids the need for complex configurations typically required for direct disk scanning, making the process faster and more reliable. The new functionality addresses several known issues with the existing version of Desinfec't. For example, the previous implementation could not operate on systems with ARM processors or Snapdragon chips, nor did it support dynamic disks managed by Windows' built-in RAID system. Additionally, it struggled with machines having less than four megabytes of RAM and required rebooting from removable media, a step that often led to complications involving secure boot, BIOS settings, and BitLocker encryption. By eliminating the need for physical media, the updated method improves accessibility and reduces user friction. The solution leverages Microsoft's shadow copying technology, which creates consistent snapshots of file systems. These snapshots are then made available as block devices through the network, enabling remote scanning without modifying the target system’s configuration. This approach ensures that the scanned data remains intact and unaltered during the process, maintaining the integrity of the files being analyzed. Developers have emphasized that the new feature is still experimental and will be fully integrated into future releases. Users interested in testing the update can download the latest version from the official repository. While the feature is currently available only for Windows systems, there are ongoing discussions about extending similar capabilities to other operating environments. The goal is to make Desinfec't even more versatile and user-friendly, ensuring it can be deployed effectively in diverse computing scenarios.