How to securely transfer files from a possibly infected WinXP machine to Linux?

Question

There is an old Windows XP installation that was being used without even an antivirus. This WinXP computer has files. These files are important and should be moved to a Linux installation. Given the lack of any security practices on the side of the WinXP owner it seems possible that the data contains malware.

I can now:

• Ignore this and simply keep using these files in Linux; after all Linux is supposed to not need AV.
  • At the very least the files should be scanned to avoid accidental redistribution of malware if they are ever sent to anyone else again
  • The files contain eg a multitude of .odt / .doc documents - maybe it's a very remote possibility, I don't know, but malicious macros are OS independent?
• Install ClamAV on Linux machine, scan the files, remove Clam afterwards.
  • AFAIK ClamAV is known for its poor detection rate - scanning the files with it is only marginally better than not scanning at all?
• Install an AV on the WinXP machine (Panda Free AV still supports WinXP, doesn't it?), scan the files there, only transfer them afterwards.
  • Which means going online with WinXP once again - this just feels wrong
• Any options I overlooked?

I feel stuck. Not sure how to progress.

Note I wouldn't like to manually inspect the files and eg remove any potentially suspicious files like .exe files while leaving safe files like .png files intact. Reason is the data is not mine, I was just asked to transfer it so that someone else may use them.

What is the accepted best practice in a situation like this?

Answer 1

In fact malwares can be present non only in plain files, but also in hidden parts of a file system (hidden files, apparently non allocated blocs, system blocs, etc.)

So, you have two different action here:

1. select what should be transfered
2. ensure that what is transfered should not contain malware

For the first part, someone, or a group of persons should identify what files should be transfered. Nothing technical here but still an important part.

For the second part, a good antivirus-antimalware solution should be used. If everything is done correctly, it will not ensure that no malware are present, but it will guarantee that it will not be worse than if the old machine had been correctly secured.

The hard part is that as soon as you mount a possibly infected media on a system you are at risk.

The following is not a magic bullet but just what I would try to use as a less bad way: I know that it can fail, but if the files on the old system have some value, I would accept the risk because I did my best to limit it. Said differently you will have to evaluate to risk/cost ratio of the operation.

1. Setup a minimal system: the less softvare and services present, the smaller the attack surface. Choose here any (decent) OS provided you are proficient enough with it. If you know many, my preference would be 1:BSD, 2: Linux, 3: Windows (*), because of the increasing complexity of the OS, and the facility to build a really minimal system. If possible the system should allow no remote access at all, and ideally only a command line console should be present (no XWindows if you can avoid it)
2. install good antimalwares on it. As you want to run it in not daemon mode, it makes sense to install more than one if you can offer it.
3. from that point on, the system has no reason to be connected to a network, except on a dedicated one for the next step, if you cannot just physically mount a device on it
4. using a non privileged account, copy all the selected files on a specific point on that system, and disconnect from the old device or system
5. at that point, the system should be disconnected from any network
6. pass all the installed antimalware tools on the new files and remove all the infected files unless you can make sure to remove the malwares (still using a non privileged account of course)

At that point, you have a file system that should be as clean as if it had always be installed on a decently protected system, and you should be able to connect it back to your normal network to copy the files on their final target.

---

(*): I do not know Mac so I cannot say whether they could be a good way here...

Answer 2

Install a Linux with good AV (ClamAV) and then copy the files.

The AV should scan while copying and prevent any problems.

As far Windows XP, Avast still has a version compatible with XP, so you may install that, use it on XP and then do the Linux+ClamAV part.

There's also another option: to put the files on a storage (like external HDD) and then use up to date online services to scan the content of that external drive.

Using XP directly connected to the internet may work too, but it's an additional risk.