7

I'm going to be connecting a notebook SATA drive to my computer via USB. This drive may be faulty so it may not work at all, however before it went supposedly "bad" it had a virus on it.

My computer is currently running Windows7. I'm guessing that the best way to open this up would be just to boot a LiveCD of Ubuntu and go from there?

2 Answers 2

15

Using LiveCD is indeed the best and safest way. Here's why:

Effect of Autorun feature

If you're using Windows Vista or XP, you might need to disable Autorun feature, so your computer doesn't try to execute anything from the infected hard disk automatically. This Microsoft KB article says:

Starting with Windows XP SP2, AutoPlay is enabled for removable drives. This includes ZIP drives and some USB mass storage devices.

In Windows 7 this "feature" was disabled by default, and this fix was backported to Vista and XP, so if you're running Vista or earlier, you need to be fully updated or download and install this update manually. This is how Microsoft "tactfully" says that the malware from your USB disks will not run:

Users who install this update will no longer receive a setup message that prompts them to install programs that are delivered by USB flash drives. Users will have to manually install the software.

Not running anything from infecting disk is not enough

If you don't execute or view or open anything (yes, including office files!) on your infected disk, the chance of infection is very small, but still non-zero. Here are some examples of how it could happen:

  1. Vulnerability in the thumbnail preview in Windows Explorer. For example, exploit Win32/CVE-2010-3970. Microsoft says:

    Exploitation can occur by simply browsing to a folder containing the malicious file - no further user interaction is required.

  2. Other vulnerabilities in Windows itself or in any of the Explorer extensions that you have installed. For example, some shell (explorer) extensions are still vulnerable to DLL Preloading remote attack.

  3. You must remember to disconnect it from your computer if you reboot, so your computer won't try to boot from the infected disk.

Conclusion

Because of the issues outlined above, I think the safest way is to use a bootable ("live") CD, scan the disk with an antivirus, then cherry-pick the files you need and copy them selectively to other media.

2
  • Alright this would work to see if the disk is detectable. I like your answer the best I'll mark it accepted. Oct 12, 2011 at 19:51
  • using the cmd prompt with dir and cd could prevent 1 and 2 from happening Oct 12, 2011 at 23:32
1

Ubuntu or other non-windows LiveCD will give you a lot of protection, as it would have to be multi-OS malware, so the likelihood here is negligible, but...

Various forms of malware DO have the ability to hook into lower level activity and jump from your hard disk without you thinking you have executed, viewed or opened anything - if you are running Windows, as it tries very hard to be helpful.

The examples from comments below include Stuxnet and Autorun (which should be patched anyway, in an up to date Windows) but there are others.

8
  • 1
    Any source for this? I'm really interested in reading up on how a process is going to fire up from a non-booting drive (if nothing pokes or invokes it). Oct 12, 2011 at 19:43
  • 1
    @Kara - it can't. But there are a lot of things that do poke without you thinking you have. Especially under windows. That was kind of my point. Running Linux from a LiveCD obviates this issue.
    – Rory Alsop
    Oct 12, 2011 at 19:46
  • There's no magic in Windows. You'll need to back your claim of "hooking and jumping" by some evidence or reference.
    – haimg
    Oct 12, 2011 at 19:54
  • I will hunt down a few. You covered off the simple one with your edit :-) The problem is with windows 'magic' though. It tries to be helpful, which opens files.
    – Rory Alsop
    Oct 12, 2011 at 19:59
  • @RoryAlsop: According to a Microsoft Security Intelligence Report AutoRun is often used for automatically jumping off an external medium, other than that there doesn't exist much magic so have fun hunting as you won't find your claim. The only one you will likely find is the PIF/LNK vulnerability used by Stuxnet which has been patched since... Oct 12, 2011 at 21:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .