0

So, I think I got infected with a malware of some kind. I might not, but to be on the safe side, I will assume I am. Ater a malwarebytes scan on everything it didn't find anything particularly suspicious. Still, I will format my PC to be on the safe side.

My question now is. The virus can be anywhere. I have 3 internal drives plus the c:\ one. Also, it is possible that the virus can spread from drive to drive right?. So If I format just c:\ it will be re-activated probably from the 'infected' internal or even spread to c:\ and reactivate then (stop me when I'm getting crazy). So, my course of action would be to unplug all internal drives (except one). Do a clean install of windows on the remainder drive (the "c:\" one), then I will be 100% clean. But then how would I go about re-connecting my internal drives (having in mind that the virus is in one of them and will spread upon connection). I thought about using a third PC (fresh windows) and connect the internal drive there and check the folders individually (with malware bytes or even by eye (?)) and transfer them to this third PC, then format the drive and then transfer the files back at the drive. Still though, if the virus is undetectable it will still get passed around upon connection, no? What about if the 3d PC has linux? Will the malware never automatically transfer back and forth (drive->ubuntu->formated drive) or it will and just not be active in Ubuntu?

So, in conclusion how can I be sure that all of my discs are clean and no virus is running (besides checking every single exe)? How paranoid I am? Sorry for the long post.

*bonus paranoia: Can a virus spread from the infected windows to another pc with ubuntu through network and then back at the PC (after the format)?

  • A virus can tgeoretically spread from Windows to another PC through network and back - tlthe virus would typically be masked as an innocent file and coied, or it might be able to infect shared resources - it is unlikely Ubuntu would get infected, but it could incubate the infection. – davidgo May 17 at 10:25
  • If you want to reinstall everything you should use Linux to zero the whole disk (ie dd if=/dev/zero of=/dev/sdX). This would prevent a Virus being able to hide in unwiped partitions or boot records. Of-course, what happens if you get infected again - assuming it is a virus, have.you closed the path to reinfection? – davidgo May 17 at 10:29
  • @davidgo What path? I guess what I'm asking is general. E.g. if someone brings me a malware infested laptop? What do I do? Well, I can format the laptop and be done with it. But if the guy wants to back up certain files what do I do? If I insert an external drive (for the back up) I run the risk of infecting my external drive. And then, after the laptop format, once I plug the backup drive in the laptop to return the back up files the laptop might get infected again. It's a chicken-egg thing, and the more the files, the more the difficulties. How do you solve it, since AVs are not so relaible – Monochromatic May 17 at 10:42
  • I solve it by (a) not using Windiws, (b) using software sourced from reputable sources - and if in doubt, checksumming the files against known goid ones, (c) keeping my systems patched, (d) if that all goes tocustard having things stored a versioned NAS. – davidgo May 17 at 10:47
  • It may be worth your while studying how malware sreads - if youdont open susucioys emails and use an adblocker yy reduce the attack surface drastically. Understanding how Virii hide and spread also gives you some ability to work wit them - in order fir a virus to spread it needs to either be in memory (what you need to avoid) or innerty being moved with no control, hoping you will do somethig to activate it. Dont do things to activate it! – davidgo May 17 at 10:51
1

If you are really paranoid, you throw the whole PC away. Viruses have to be executed, but they could hide in specially crafted JPEG file that triggers a bug in the JPG decompression code and makes it execute some JPEG data as code (not speaking of Office macros).

In practice, if you scan the disk (ideally attached to another trusted PC, or if you use your original PC, boot it from an external source) with several different up-to-date scanners and none reports anything (or they all report different things... because false positives exist), then you are allowed to consider that your PC is fine.

  • Any other good free scanners besides malware bytes? – Monochromatic May 17 at 17:55
  • When I was on Windows, I used Avast. Otherwise, plenty of AV tests/benchmarks around. Note that if you have to make a boot disk to run the scanners, it could be easier to make a Linux disk and makes it run Linux-based scanners than scan for Windows threats. Such things exist. – xenoid May 17 at 19:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.