My desktop PC was recently infected with malware.sality and virus.sality--which, among other things, installed a keylogger--and I have been unable to remove all of it with the steps recommended in the Malware Removal Guide for Windows. Even though MalwareBytes detects and removes it, the registry key HKLM\SYSTEM\CurrentControlSet\Services\ansint32 is still present the next time I scan.
I am resigned to reformatting and rebuilding the hard drive, but would like to save my photos, personal documents, spreadsheets, and some pdfs. My current plan is to copy the files over to an external hard drive and scan that using another (clean) PC, but I have a number of questions around this.
(1) Since none of the file attributes (date/time stamps) have changed, what are the chances that the files are infected?
(2) If the files are infected, is there any chance that connecting the external hard drive to another computer for scanning can in some way infect the second system?
(3) If the scan comes out clean, can I fully trust those files, or is it best to keep them segregated on the external drive and not move them to the newly-reformatted and reinstalled system?
(4) Instead of doing a partial cleanup of the hard drive as suggested in a different post (i.e., deleting any executable files and removing other files you're not interested in) I'd like to know if that is necessary, or if I can simply work my way through the file structure in Windows Explorer and copy out what I want?
(5) For the reformatting and reinstallation, if I wanted to have someone do this for me, is this something most computer repair places can do?
Thanks for your help.