Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite

I had to reinstall my OS (windows) recently due to a virus. I backed up my source files onto a flash drive. How can I get to those files without problems? I know flash drives can have nasty things in the autorun, but let's say I put the drive on a linux machine and try to read the files off of it, would that be ok? What could actually be embedded within the files themselves that could hurt my new, clean install?

share|improve this question

2 Answers

up vote 4 down vote accepted

There is an abundance of ways untrusted files could cause harm to your system.

One popular way to verify if any single file is malicious is to use Virus Total: http://www.virustotal.com/

Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines.

Short of re-installing everything from trusted sources you cannot get 100% assurance everything is clean.

share|improve this answer
I have a lot of java source files in my backup. How could a text file be modified to harm a computer? – shady Nov 12 '10 at 18:15
There are ways that even an apparent text file could be harmful... but don't forget, it's NOT a text file, its source code - and these are instructions you give to your compiler, to turn into instructions to give to your OS. – AviD♦ Nov 14 '10 at 2:17
2  
@shady: How do you know it is a text file until you look at it? The crux of the whole problem is the lack of separation between data and code. Anything that is data can become executable code -- if the data could magically be marked as "never execute," (including crashing the viewer, etc) then you wouldn't have to worry. You could have hidden files on your USB that are malicious. That being said, the chances are very low that you will be harmed by a what appears to be a text file. Mitigate that risk if you can. – rox0r Dec 14 '10 at 20:54
up vote 4 down vote

If you really, reallyreally, reeheeeelly need those files - and I urge you to rethink that - defintely don't try to access them from a regular machine, but use a clean, throwaway machine you can load up on AV and forensic tools, and then trash it later. Make sure you're fully up to date, and running with minimal privileges. Run at least two AV scans on it, and manually check the files on the temp machine (i.e. if these are java source files, LOOK at them. READ the code.) Try not to restore anything more complicated.

Oh, and don't call it backups, if you took them AFTER the damage was done :).
Hope you learned, and start doing backups BEFORE it's too late...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.