Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My desktop PC was recently infected with malware.sality and virus.sality--which, among other things, installed a keylogger--and I have been unable to remove all of it with the steps recommended in the Malware Removal Guide for Windows. Even though MalwareBytes detects and removes it, the registry key HKLM\SYSTEM\CurrentControlSet\Services\ansint32 is still present the next time I scan.

I am resigned to reformatting and rebuilding the hard drive, but would like to save my photos, personal documents, spreadsheets, and some pdfs. My current plan is to copy the files over to an external hard drive and scan that using another (clean) PC, but I have a number of questions around this.

(1) Since none of the file attributes (date/time stamps) have changed, what are the chances that the files are infected?

(2) If the files are infected, is there any chance that connecting the external hard drive to another computer for scanning can in some way infect the second system?

(3) If the scan comes out clean, can I fully trust those files, or is it best to keep them segregated on the external drive and not move them to the newly-reformatted and reinstalled system?

(4) Instead of doing a partial cleanup of the hard drive as suggested in a different post (i.e., deleting any executable files and removing other files you're not interested in) I'd like to know if that is necessary, or if I can simply work my way through the file structure in Windows Explorer and copy out what I want?

(5) For the reformatting and reinstallation, if I wanted to have someone do this for me, is this something most computer repair places can do?

Thanks for your help.

share|improve this question

No, it does not. The answers you're looking for are only a Google search away: Encyclopedia: Sality

I quote:

File infection Virus:Win32/Sality.AT injects code into all running processes to load and run the virus and infect Windows executable files with extension ".EXE" or ".SCR". The virus seeks other target files by reading file names found in the following registry subkeys:

share|improve this answer

In general:

  • Malware can hide itself in pretty much every file, but this is only effective if the hidden code gets somehow executed. Images are perfectly save. So are text files.

  • Word document can contain malicious code that gets executed by Word (macros). However, only a small portion of malware actually does this. As @Mahmoud Al-Qudsi already pointed out, Sality doesn't.

Regarding your specific questions:

  1. Forging a timestamp is trivial. You cannot rely on that.

  2. The autorun feature might execute commands when connecting an external hard drive. Windows XP was vulnerable to this. Windows Vista and 7 (with factory settings) are not. However, this behavior can be changed by the user (or other malware).

  3. The is no malware scanner that detetcts all malware. But it doesn't matter where you store the files.

  4. What different post?

  5. This is one of the most basic tasks that every so called computer repair place should be able to handle.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .