Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've recently read that the data that you deleted in windows using shift+del doesn't actually get deleted it is just made to be overwritable by other data that will soon be stored in your hard drive. And just marked as deleted. And there are some articles like this: http://www.howtogeek.com/howto/15037/use-an-ubuntu-live-cd-to-securely-wipe-your-pcs-hard-drive/ that shows how to completely wipe out the hard drive of all the data. And thus the data can't be recovered even by the most advanced software for recovering deleted data.

Now my question is, does spyware, virus or other harmful really are lost forever if you reformat your drive?

share|improve this question

7 Answers 7

up vote 6 down vote accepted

Yes. Format drive will remove everything including spywares and virus and also your valuable data. Backup your data first before format.

However, there is a sector in Hard Drive that Format would touch. This is the first sector in Hard Drive, the Master Boot Record (MBR). In DOS or Windows 9x time, some smart viruses alter the MBR code and reside in the sector. Even format the drive wouldn't remove the virus completely.

It is advisable you also do rewrite MBR to make sure all malicious code are gone.

To format MBR in DOS/Windows 9x/Windows XP, use

FDISK /MBR

To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment:

bootrec.exe /FixMbr

Read the following article for information on how to start Windows Recovery Environment:

How to use the Bootrec.exe tool in the Windows Recovery Environment to troubleshoot and repair startup issues in Windows

share|improve this answer
    
boot-sector viruses are an important part of the picture which was left out of the accepted answer. Granted, you don't see too many of these, but they do exist, and you should at least be aware of this possibility. –  eidylon Apr 20 '10 at 3:14
    
thanks, this enlightened me. I never knew this kinds of virus exist –  Ieyasu Sawada Apr 20 '10 at 6:24

In addition to what the others have said, used to be a lot of MBR viruses that you couldn't remove simply by reformatting--you had to also overwrite the master boot record. Now MBR viruses seem to be less common, but they do still exist.

Back in the day, MBR viruses spread via floppy disks. As removable media has advanced, so have viruses, trojans, worms, and other malware. Modern malware can spread via USB flash drives and network shares, and is sometimes self-propagating (that is, it is executed via some automated mechanism and it and replicates on its own, without your intervention).

For the most part, if you reformat your drive, you should be safe. But if you use a disk wiping utility like DBAN or write zeroes to the drive, you are guaranteed to be rid of the malware, unless you get reinfected from the original source or some other infected device.

Before you wipe your hard drive, be sure to backup all your data, and from that point forward, treat the entire backup as a possible source of infection, until you've thoroughly scanned all the backed up files with several top-rated antivirus/anti-malware tools.

share|improve this answer

The data is still there if someone goes looking for it, but the good thing is that no one will go looking for it. The issue with spyware / viruses is that it runs without your permission. If you reformat your drive, since the files are 'lost', they can no longer run without someone trying really really hard.

share|improve this answer

A smart virus won't allow itself to be deleted, it will substitute something else and pretend it deleted the file.

Reformatting your drive however will remove all traces of everything from your system. This won't prevent you from getting reinfected if you visit harmful sites but it will remove the virus.

share|improve this answer

You must understand that Windows(or any OS) will only execute files that it "knows" are there. Windows "doesn't know" that the file is there if it is marked as being overwritable.

So, put simply. If you mark the infected files as being overwriteable, then it will be next to impossible to get Windows to execute those files. In fact, the only way would be if you had a really (read: virus that does not yet exist) persistent virus, or if you used tools to recover the deleted files and then executed the deleted files.

Once is it marked as deleted, it won't be executed again. Thus, even though the virus is still on your harddrive(technically), Windows will not run it, so it is effectively neutralized.

share|improve this answer

Aswering directly to your question, they are technically lost, and every file is lost too, but it's true what you say about deleting in windows, that the operating system only marks it as deleted, anyway if you are worried about getting lost of spyware, yes, by reformatting your drive they are lost.

share|improve this answer

Malware in general is only a problem when it is run.

For example, If you have a .exe that contains code which will install a backdoor, the file itself is classed as a virus but will do no damage unless it is run.

As for formatting your hard drive / reinstalling Windows - if you copy all your data back without knowing where/what the virus is, there is a chance it still there, but as pure data, not doing any damage until it is executed.

Regarding Delete vs Shift+Delete. The first simply moves it to the recycle bin (where you can then choose to delete), The second basically skips out the recycle bin. When a file is in the recycle bin, it is not really deleted and can still be run (in fact, some viruses hide out in the recycle bin system folder).

Even if the file has not yet been written over, a proper delete (NOT recycle bin) would mean that it cannot be executed.

I should just point out and warn you that what I say above is mainly true, however it is possible that malware was installed by taking advantage of a flaw / security hole on your machine - For example, a while ago, there was a bug with WMF images, so if you just selected a picture that had the virus attached, it was possible that Windows would get infected whilst generating the preview.

share|improve this answer
3  
Has anyone else noticed that the "Shift" keyboard-button-thing (with the KBD command) is lacking an "f"? –  Maxim Zaslavsky Apr 20 '10 at 1:34
1  
I think Wil wanted convey the the expression that runs through your mind when you see the antivirus scanner pop up an alert. –  rob Apr 20 '10 at 1:52
    
@Maxim z, @Stephen Jennings - +1 whoops, typo... I suppose if I am missing letters, it could be worse... not talking about counting! –  William Hilsum Apr 20 '10 at 10:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.