2

I was recently asked to help a friend fix a virus laden computer and I was wondering if it is possible for viruses infecting another computers hard drive could pose a possible risk if I connect that hard drive to my computer to image it? Is it possible for viruses to jump hard drives without being executed on the original host OS's computer? Would removing the assigned drive letter to the infected hard drive be an effective defense? Should I just use Linux to image the drive so that I do not have to worry about the possibility of Windows viruses somehow infecting my own computer?

Improve this question

2 Answers 2

Reset to default
4

It is safe to connect a harddisk that is infected with a virus as long as you don't do the following:

  • Don't boot the harddisk's Operating System
  • Don't execute any file that is on the harddisk.
  • If you copy files, make sure you scan those files for virusses before you open them. Even if the files that are copied contain a dormant virus, you will copy the virus, and it will become active if its code is launched.

Basically, if you use linux to just make an image of the harddisk as a backup so you can go back to that stage, its okay. If you use it to copy documents etc off the hardisk so it can be transfered back after a reinstall, scan those files first.

As with any virus infection, if you are unsure if the thread is completely gone, go safe and do a full format and OS reinstall after you backed up important files and scanned those for virusses.

Do note: A virus can be in the following:

  • Executables (.exe, .com, .msi, .scr)
  • Batch files (.cmd, .bat) (they won't contain the virus, but they can launch a program that contains the virus.
  • scripts (.vbscript, .vbs, .ahk, etc..., basically anything that can be executed through a different program can alter the system and/or launch a virus)
  • Microsoft Office files (.doc, .docx, docm, .xls, .xlsx, .ppt, .pptx, .odt, etc.) They can contain macro's which can infect a system.

There are probably more files that can be affected, so always scan. You'd better be safe than sorry.

Improve this answer
2
  • In other words, only if you really know what you are doing, and I think that since you are asking here, you're not sure.
    – Xavierjazz
    Jul 20, 2014 at 1:10
  • No i was pretty sure of the fact that unless I go and start running executable files from the infected hard drive I was OK, just wanted to be sure.
    – Richie086
    Jul 20, 2014 at 2:28
2

It doesn't matter from what device a virus is executed. It can be your drive, drive taken from another computer, flash drive, iPod, anything. If you execute the virus, it will very likely infect the computer you're executing it on - in this case your computer.

Executing an external virus automatically is quite hard on modern versions of Windows, but viruses use some clever ideas to trick you into running them. The more secure solution is to use some Linux distribution for that task. Linux is unable to run Windows executables, so it's immune to Windows viruses. But be careful not to boot Windows accidentally!

Ideal solution would be to image that drive in its original PC using a LiveCD distro of Linux, for example Ubuntu or PartedMagic. You can use an external drive as a backup target.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .