1

Is it safe to scan and clean an external hdd of malware/virus on an otherwise clean system ie my system!?

Does the antivirus software on my machine do it's work externally? ie if a virus is detected does it quarantine the object to somewhere on the external hdd rather than onto my machine?

Would using a separate user account for this work be of any benefit? Thanks.

  • You need to have solid anti-virus to do it. Try using Panda Free. – Aria Nov 21 '16 at 11:23
2

Are you sure tour system doesn't have an application that scan or index new devices? Like a media player that tries to extract metadata from multimedia files.

I would recommend booting from a live CD or live USB in read-only mode, not mounting your partitions, and disconnected from any network. After that load [a VM with] your antivirus, then mount your external drive and check it. However, this will not prevent a rootkit from infecting your BIOS and you will have no guaranty that your antivirus found all the malware. It's still better than nothing.

If you want a bullet proof method to remove your virus from the drive, the only way is to destroy it. Erasing it is not enough, as its firmware could be infected.

  • 1
    Agree. If you do not want that a possible malware writes anything on your disk, use a read only disk (CD or DVD ROM). – Serge Ballesta Nov 21 '16 at 13:58
  • Bit Defender Rescue CD looks to be pretty highly regarded, will scanning the drive from this environment avoid any interference with my clean system drive? – Kol12 Nov 22 '16 at 1:04
  • @A.Hersean Is it possible to retrieve the valuable files before destroying if that route was taken? – Kol12 Nov 22 '16 at 1:06
  • @Kol12 I don't know this particular product, but Bit Defender Rescue CD might be a good solution, at least for its convenience. I would recommend using an old unused computer for this task as it's still possible for it to get infect, even though highly improbable. To reduce risks, do not recover files that can otherwise be download from trusted sources and do not recover executable files. – A. Hersean Nov 22 '16 at 8:13
  • Sounds like a plan @A.Hersean. Are you suggesting it would it be better to move the valuable files off the drive and format the drive or would the files remain safe on the drive once fully virus cleaned? – Kol12 Nov 22 '16 at 8:53
1

First of all always use a virtual machine instead of your installed OS and mount it in read only mode when doing something with (probably) infected externals!

This prevents your PC/Account from being infected by whatever is on this HDD. Most likley a usual anti-virus should then be able to detect most of the malware and delete it.

If you doubt it anyway you can completely wipe the HDD using the VM.

In addition, there are already posts on this topic:

  1. Safe to connect to external drive?

  2. Mac OSX: What is the safest way to access an unknown USB storage?

  • Wow! I always thought that a VM was just a client program on the host and did not know that you could install a external disk on a VM without first plugin it on the host... Maybe it is because my PC has no virtual connectors only real ones. More seriously, before you can mount the external disk on the VM you have to connect its physically to the host... and the risk is there is you have not blocked any automount feature first. – Serge Ballesta Nov 21 '16 at 13:53
  • Thanks for the reply's. @A.Hersean I have autorun disabled so the drive doesn't get scanned. I use Windows Defender (Win10) which also does not scan the drive on mount. Using Win 10 home edition a virtual machine won't be an option, could I still boot from a live cd without using a VM? – Kol12 Nov 22 '16 at 0:16
  • Now that I think of it I have another computer downstairs that I could set up for this job but will have to pick up another monitor. So that will greatly reduce any risk to my system but once the drive has been cleared of viruses how safe are the remaining valuable files? I may end up using this drive on my machine again. I suppose unless a virus has made it's way into the firmware which I understand is rare it should be clear? – Kol12 Nov 22 '16 at 6:44
  • As @A. Hersean pointed out, the only bulletproff method is destryoing it. – Gistiv Nov 22 '16 at 6:54
  • I should note also that I use my personal machine with a standard user account as another security barrier against any virus entering administrative directory's. – Kol12 Nov 22 '16 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.