1

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the top of Bing if you search "Firefox download" right now...

I ran a scan with AVG and a scan with MalwareBytes. Both showed some Adware (about 3 entries total) and those entries were removed. I also installed Firefox from a known, good source and also had to revert a few settings in IE (homepage, default search provider).

However, I am a paranoid person and want to wipe the Windows install on the SSD and start from a clean slate. What is the best way to do this?

Here are the options that I've been able to find:

  1. Do a secure erase via a third party utility and boot CD. This might take some time since I don't currently have either a USB drive I can use to boot from or a CD-ROM drive on a non-infected machine.
  2. Use Diskpart (from Windows 7 install media) to do a clean/clean all. What are the benefits of the clean all versus just the clean? Will any of these operations hurt my SSD? The drive in question is an 850 Evo, so I'm not too concerned about write endurance.

My goal is to start with a 100% fresh drive and Windows install. Also, there's a second drive in the system that I had planned to install Linux at a later date. It should be totally unformatted and in factory new condition (Windows never saw the drive come up when you clicked on "Computer"). Do I have to follow similar steps for wiping on that drive as well?

Thanks in advance for the help.

2 Answers 2

7

If you're trying to eliminate malware, a simple format is sufficient.

Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries pointing to the files containing it, the fact that it's marked as executable code, the registry entries for running it, and so on. Eliminate all that, as happens during a format, and it's just a harmless pattern of bits.

2
  • Thanks for this. So a simple diskpart clean and a Windows install on the affected drive should suffice? I don't have to worry about the other drive (currently marked as unallocated space)?
    – It'sPete
    Commented Apr 6, 2015 at 21:35
  • 3
    Right. If the other drive is unformatted, the malware would not have even been able to see it.
    – Mark
    Commented Apr 6, 2015 at 22:04
0

In addition to what @Mark said about formatting your hard drive, you should format the Master Boot Record as well. It's very unlikely that your adware was that insidious, but better safe than sorry. To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment:

bootrec.exe /FixMbr

Here's more info on Bootrec.exe

Similar question on SuperUser.

6
  • Pardon my ignorance, but does a diskpart clean take out the MBR? All I have listed afterwards is unallocated space.
    – It'sPete
    Commented Apr 6, 2015 at 21:50
  • So my understanding (and I'm by no means a Windows disk expert, but I have been frantically Googling in the past few hours) is that diskpart clean will zero the first and last 1MB of the drive, and that will zero out the MBR. Here's what I found: sevenforums.com/general-discussion/…
    – It'sPete
    Commented Apr 6, 2015 at 22:18
  • Also, won't the MBR be overwritten once I perform the Windows install? That is, I use diskpart to get to unallocated space and then I run the Win 7 installer from there.
    – It'sPete
    Commented Apr 6, 2015 at 22:20
  • Also found this: sevenforums.com/system-security/… Seems like diskpart will take care of zeroing the MBR.
    – It'sPete
    Commented Apr 6, 2015 at 23:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .