Solved Rescue data from virus HDD

Ricsie

New Member
Messages
4
Hello
I have a external HDD, which probably have some viruses. because:
I had virus on my PC, no antivirus could see it and tried quiet a lot, and chose fro the bests,but my PC always froze, im having two HDDS in my computer and if i removed on formatted the first reinstalled windows it was good when i connected the second it started freezing so im 100% sure i had virus.
So started windows safe mode, and backed up some very important files, mainly school documents and projects to external HDD in safe mode,

Now i need some of the files back, what should i do? If i boot up the Linux or BSD and copy here the important files back and then format the hard-drive would it help?

Thanks
 

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
This might actually be a hardware fault (your second drive failing maybe...).

From your explanation I understand you think your 2d HDD is infected right ? If your second drive only contains data, and no executables then it should be safe assuming you have autoplay off at least on this drive. The same is true for your external HDD. If your main drive (where the OS is installed) is infected then the safest solution is to wipe it (and probably get rid of the mbr with partitioning tools).

Anyway I would recommend using a live cd. Some knoppix based ones are made especially for this task, and they contain partition/av tools.

- Disconnect your external HDD (to avoid wiping it by mistake).
- Boot from the live cd.
- Launch GParted and delete all partitions on both HDDs
- Follow this thread to clean the MBR on each one : I want to delete the Boot Sector (Page 1) ? Live Media ? GParted forum
- Reconnect your external HDD.
- Scan it with any AVs included on the live-cd if you want (not really necessary but you might as well do it)
- Disconnect your external HDD (important)
- Reinstall/Restore your OS (I assume you have the discs or an image) on HDD1 and boot from it.
- Once the OS is reinstalled, Disable Autoplay on all drives (this is a useful feature but very bad for security).
- Disable all macros in word/excel (highest security level in each one) and disable javascript in adobe reader (or only use a lightweight pdf reader like sumatraPDF)
- Only then can you reconnect your external HDD
- Uncheck hide system files in file explorer (folder/options)
- Check if there's an autorun.inf file on the external disk's root, if so delete it.
- Move the location of each libary folder to some new folder on HDD2 (ex: right click My Documents in file explorer, properties/location/move to)
- Copy all your data files in the appropriates library folder which will be redirected automatically to HDD2
- Download/Install a disk imaging application (Macrium Reflect FREE Edition - Information and download is good and free)
- Follow the instructions to create a bootable disc/usb this program
- Make an image of HDD1 to your external disk and/or a dvd/usb stick.

If anything happens again, just reboot from cd/dvd with your imaging soft and get a clean install very easily with all your data safe (HDD2).
 
Last edited:

My Computer

System One

  • OS
    Windows 8.1 (x64)
    Computer type
    PC/Desktop
Thank you very much, i did everything this way, and reconnected the HDD. deleted all exe files, it was just some random not very nice apps i programmed i can anytime recompile :-D and it looks good, i formatted it in linux and cleaned up, if it will start freezing again, i will get rid of the MBR too, otherwise the HDD contained just images, documents, videos, pdfs, so hope finally i should be virus free :)
 

My Computer

System One

  • OS
    Windows 8.1
    Computer type
    Laptop
Back
Top