the Forensic Incident Response Environment ie FIRE is what you need.. it's a live boot linux cd with forensic tools galore.. including f-prot which allows you to scan from a trusted source and trusted definitions on a floppy.. http://biatchux.dmzs.com/