4

I've recently read that the data that you deleted in windows using shift+del doesn't actually get deleted it is just made to be overwritable by other data that will soon be stored in your hard drive. And just marked as deleted. And there are some articles like this: http://www.howtogeek.com/howto/15037/use-an-ubuntu-live-cd-to-securely-wipe-your-pcs-hard-drive/ that shows how to completely wipe out the hard drive of all the data. And thus the data can't be recovered even by the most advanced software for recovering deleted data.

Now my question is, does spyware, virus or other harmful really are lost forever if you reformat your drive?

9 Answers 9

7

Yes. Format drive will remove everything including spywares and virus and also your valuable data. Backup your data first before format.

However, there is a sector in Hard Drive that Format would touch. This is the first sector in Hard Drive, the Master Boot Record (MBR). In DOS or Windows 9x time, some smart viruses alter the MBR code and reside in the sector. Even format the drive wouldn't remove the virus completely.

It is advisable you also do rewrite MBR to make sure all malicious code are gone.

To format MBR in DOS/Windows 9x/Windows XP, use

FDISK /MBR

To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment:

bootrec.exe /FixMbr

Read the following article for information on how to start Windows Recovery Environment:

How to use the Bootrec.exe tool in the Windows Recovery Environment to troubleshoot and repair startup issues in Windows

3
  • boot-sector viruses are an important part of the picture which was left out of the accepted answer. Granted, you don't see too many of these, but they do exist, and you should at least be aware of this possibility.
    – eidylon
    Apr 20, 2010 at 3:14
  • 1
    thanks, this enlightened me. I never knew this kinds of virus exist Apr 20, 2010 at 6:24
  • In light of information we now have due to the Snowden leaks, this answer is no longer accurate and could be misleading. We now know that sophisticated techniques exist and are actively used, for malware to survive a reformatting, and that this is not just limited to the MBR, or even the hard drive. The drive's firmware, or the computer's BIOS, are both viable targets. Furthermore, any attempt to format the MBR which is made from the infected machine, should not be relied upon. Apr 28, 2015 at 17:09
3

In addition to what the others have said, used to be a lot of MBR viruses that you couldn't remove simply by reformatting--you had to also overwrite the master boot record. Now MBR viruses seem to be less common, but they do still exist.

Back in the day, MBR viruses spread via floppy disks. As removable media has advanced, so have viruses, trojans, worms, and other malware. Modern malware can spread via USB flash drives and network shares, and is sometimes self-propagating (that is, it is executed via some automated mechanism and it and replicates on its own, without your intervention).

For the most part, if you reformat your drive, you should be safe. But if you use a disk wiping utility like DBAN or write zeroes to the drive, you are guaranteed to be rid of the malware, unless you get reinfected from the original source or some other infected device.

Before you wipe your hard drive, be sure to backup all your data, and from that point forward, treat the entire backup as a possible source of infection, until you've thoroughly scanned all the backed up files with several top-rated antivirus/anti-malware tools.

2

You must understand that Windows(or any OS) will only execute files that it "knows" are there. Windows "doesn't know" that the file is there if it is marked as being overwritable.

So, put simply. If you mark the infected files as being overwriteable, then it will be next to impossible to get Windows to execute those files. In fact, the only way would be if you had a really (read: virus that does not yet exist) persistent virus, or if you used tools to recover the deleted files and then executed the deleted files.

Once is it marked as deleted, it won't be executed again. Thus, even though the virus is still on your harddrive(technically), Windows will not run it, so it is effectively neutralized.

2

Malware in general is only a problem when it is run.

For example, If you have a .exe that contains code which will install a backdoor, the file itself is classed as a virus but will do no damage unless it is run.

As for formatting your hard drive / reinstalling Windows - if you copy all your data back without knowing where/what the virus is, there is a chance it still there, but as pure data, not doing any damage until it is executed.

Regarding Delete vs Shift+Delete. The first simply moves it to the recycle bin (where you can then choose to delete), The second basically skips out the recycle bin. When a file is in the recycle bin, it is not really deleted and can still be run (in fact, some viruses hide out in the recycle bin system folder).

Even if the file has not yet been written over, a proper delete (NOT recycle bin) would mean that it cannot be executed.

I should just point out and warn you that what I say above is mainly true, however it is possible that malware was installed by taking advantage of a flaw / security hole on your machine - For example, a while ago, there was a bug with WMF images, so if you just selected a picture that had the virus attached, it was possible that Windows would get infected whilst generating the preview.

3
  • 3
    Has anyone else noticed that the "Shift" keyboard-button-thing (with the KBD command) is lacking an "f"? Apr 20, 2010 at 1:34
  • 1
    I think Wil wanted convey the the expression that runs through your mind when you see the antivirus scanner pop up an alert.
    – rob
    Apr 20, 2010 at 1:52
  • @Maxim z, @Stephen Jennings - +1 whoops, typo... I suppose if I am missing letters, it could be worse... not talking about counting! Apr 20, 2010 at 10:23
1

The data is still there if someone goes looking for it, but the good thing is that no one will go looking for it. The issue with spyware / viruses is that it runs without your permission. If you reformat your drive, since the files are 'lost', they can no longer run without someone trying really really hard.

1

Aswering directly to your question, they are technically lost, and every file is lost too, but it's true what you say about deleting in windows, that the operating system only marks it as deleted, anyway if you are worried about getting lost of spyware, yes, by reformatting your drive they are lost.

1
1

I'm adding this answer to provide an alternative to some of the misleading (and in some cases, totally incorrect) answers on here.

Malware can and does survive formatting a hard drive e.g. through the boot sector and or firmware. As we now know from the Snowden leaks, these methods are actively used by the NSA, and probably other governments and criminal entities around the world.

Even discarding the hard drive and replacing it with a new one is not a sure way to remove malware. Malware can infect the BIOS (see also the Schneier link above).

With that in mind, the easiest and most reliable way to have a high chance of eradicating malware, is to replace all items of hardware which contain any sort of firmware and which could have come into contact with malware. This would mean the motherboard and the hard drive, at a minimum - although be aware that any privileged hardware with any sort of firmware is a possible target - e.g. keyboards.

However, for the truly paranoid, even that may not be enough, as it has been revealed that the NSA can and do intercept hardware deliveries en-route, to be infected with malware.

Here's a similar question which may be of relevance.

1

A smart virus won't allow itself to be deleted, it will substitute something else and pretend it deleted the file.

Reformatting your drive however will remove all traces of everything from operating system. This won't prevent you from getting reinfected if you visit harmful sites but it will remove the virus.

I'll note this doesn't take into account a firmware hack which would be invisible from the OS level and likely not removable through ordinary means.

4
  • This answer is wrong. See here. Apr 28, 2015 at 16:58
  • This answers is technically correct in that it removes it from the system. The system is not the hard drive's firmware.
    – Josh K
    Apr 29, 2015 at 0:33
  • I'm not sure I understand you. Most people would interpret "the system" as meaning every item which combines to make up your computer. This is the definition that wikipedia uses. Either way, your answer implies in extremely strong terms (due to the bolding) that a user can be satisfied he has erased a virus merely by reformatting a hard drive. Apr 29, 2015 at 10:43
  • I'm considering the operating system.
    – Josh K
    Apr 29, 2015 at 14:13
0

I did this and usually, it would get rid of it however the virus write itself. This time the virus put itself onto the flash memory of the BIOS. On top of that, it switched the C and D drive. So when I went to format the D drive where my software was, my C drive was erased. I ended up having to flash my BIOS to get rid of the virus and format both drives to ensure that it was gone. So typically YES however it in my case it burned me because it snuck onto the BIOS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .