1

I stupidly saved an .exe file that claimed to be an urgent Firefox patch (318K).

I haven't (and won't) run it, but how can I delete it so that it's gone, i.e. no risk to my Win7 laptop?

I thought of opening a large file (like a photo) and saving that as the malware file name, hoping to overwrite it... but after looking around here feel doubtful that that would work. Kaspersky AV didn't find any problem with it but I want it gone.

As it happened, I couldn't attend to this for the last few days, and in the interval Kaspersky learned to recognize it. I went looking for the file, and found it in quarantine--where I'll leave it.

Thank you everyone for your answers. I guess I had the idea that even if a malware file was deleted, it might somehow have the ability to self-activate, or accidentally be activated in some way. It's a relief to know they're not quite as magical as I imagined.

Improve this question
3
  • 7
    Is there a reason you can't simply delete the file? And then empty your recycling bin if you feel someone might retrieve it?
    – Numeron
    Jun 16, 2016 at 3:28
  • 1
    If you really want to be sure about the file, upload it to virustotal.com. It let's you scan the file with approx. 50 different anti virus scanners. Then you can take the majority vote.
    – Potaito
    Jun 16, 2016 at 7:15
  • @Numeron: There may be valid reasons why simply deleting the file may not be enough, for example if you live in an assumed constitutional democracy where governmental agencies are the innocent citizen's most dangerous enemies, and where "possession" of their malware will be used against you. I remember a case from 2010 published on Heise where a virus researcher had his home searched and computers seized on the premise that he was "spreading malware" because he had (intentionally, of course) downloaded a malware-carrying jpeg from a governmental malware distribution server.
    – Damon
    Jun 16, 2016 at 8:17

3 Answers 3

Reset to default
7

Malware files by themselves are not special in any way, they're just like any other file albeit with a malicious purpose.

So, you can simply delete it as you would any other file. If for some reason you feel that someone (yourself included) might go digging through your computers recycle bin, you can also empty it to prevent accidental retrieval.

Improve this answer
1
  • 1
    Hint: Marking a file and pressing Shift+Delete deletes it without putting it into the recycle bin first.
    – Philipp
    Jun 16, 2016 at 8:17
0

I'd take 3 steps:

Delete the file.

Complete a virus scan after deleting the file, using an alternate up-to-date with virus definitions VS scanner that you've totally researched.

Consider decent AV software that assists in flagging files in case a download like this happens again and you miss it.

Improve this answer
3
  • Just curious about the reasoning: Kaspersky AV did not find any virus, so let's delete a file and check with alternate, decent AV software. Usually you test, perform an action, test again to confirm the action was successful or did not break something. What's the idea behind this answer? Testing with different tools, but one at a time before and after the action only.
    – techraf
    Jun 16, 2016 at 5:52
  • To be honest, I think some AV scans might be more immediate than AV software kits and preventive measures were not in place when the exe file was downloaded,, ie - decent av software should have detected an exe. file upon download - so who knows what was on the users computer already... IE- the faster response, the better.. That was the logic, anyway...
    – Suzy Easton
    Jun 16, 2016 at 5:58
  • I mean regardless of malicious intent, my software kit double checks with me whether an exe. file that I intentionally or unintentionally just downloaded is really okay... that didn't happen so something seems not up to date..,
    – Suzy Easton
    Jun 16, 2016 at 6:15
-1
  1. Delete the file (and I really mean delete, not just put into the recycler)
  2. Defrag (if you feel paranoid).
  3. Profit.

Deleting the file won't execute it, so there's no risk to do it. Deletion will only mark the area used by the file as 'free', and OS will not be able to access it the normal way. It's not really readable unless you use forensic/data recovery tool. To really get rid of the contents of the file, run defrag (on a mechanical HDD), or just keep using the PC as normal, which will (sooner or later) overwrite this area. SSDs will zero the 'free' areas automatically as a part of their automatic wear leveling and housekeeping routines, and you can't really influence this (you should not defrag them or 'shred' the contents, because this isn't as reliable as on HDDs and it causes quite a bit of wear and tear on the silicon structure).

Scanning the PC for viruses is a good idea, but that should be performed at least semi-regularly anyway. Keep in mind that if that's a new threat (not yet examined by AV creators) it might not be detected (which is why you should scan older, unchanged files too) and therefore - it won't be reported as a threat. That's why you don't run untrusted files, especially the 'suspicious' ones, unles you really have to.

In the end, this situations shouldn't cause any problems. Just delete the file and you should be OK.

Improve this answer
3
  • SSDs will zero the 'free' areas automatically as a part of their automatic wear leveling and housekeeping routines This is probably what got you the downvotes because it's not true. 1) SSDs should not be defragmented and nowadays you'll rarely find a program that lets you do it. 2) SSDs only know the TRIM command which releases the storage block by marking them as "deleted". It does not overwrite with zeros as that would only wear the flash. The data could still be acquired through forensic means though.
    – Potaito
    Jun 16, 2016 at 6:57
  • That's why I have written "run defrag (on a mechanical HDD)" - I did not suggest defragging an SSD. As for TRIM - I'm pretty sure I've read a paper saying that at least some SSDs do the erase on the data blocks marked 'deleted' when they're idle, to save time when saving data (by not having to do the erase cycle then). Sorry if I'm wrong, didn't mean to mislead.
    – Jakub
    Jun 16, 2016 at 7:59
  • Ah I missed the mechanical part, sorry. I did not downvote your answer though.
    – Potaito
    Jun 16, 2016 at 8:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .