First of all I am really sorry for my English. It is not so perfect at all. Please feel free to refer to that in your future comments if you like too or, if you could be so kind as to, just ignore that. (-:
Second, I am not quite sure whether this is the best place for addressing my questions. In the case being not please help me find the better one.
Third, I am totally new here and I am going to read everything about rules etc. but now I’ve got tricky situation here and stakes could be high for me, so I have no time to do this before asking all of you.
Please, regard also, I have purely theoretical/analytical background and I’ve been playing all that information technology things since very short (to be perfectly honest, only a few months). So my only weap3n for now is logic, open mind (as I am capable to) and patience.
I have an external drive for my usual everyday not-important files (music, photos favourite text files etc.,), partitioned in windows os. Yesterday I sent somebody a few docs – we used to have a conversation on a http site where people used to have such a kind of conversations. She answered me that all are infected (she scanned files with software) and she won’t open them. ‘Good choice’, I thought. I asked for logs from her antivirus, but she can’t send me them.
So below I describe scenarios which I can imagine:
1) I'd gotten infected earlier than the conversation was beginned (I hope not to);
2) Some UFO, NSA, GRU or other bad people with all their fetishes and colours of their hats has infected my files somewhere in the middle of the road from my host to her (found something here: https://www.youtube.com/watch?v=SeVz36FN61w);
3) She lied to me;
Regardless third option, I should probably take this situation serious.
Maybe there are some other possibilities and perhaps you could help me investigate them but, actually, this is not the case, I think (at least of my interest now), cause I am not doing forensics and any other things like that. I am just really concern about my computers.
So my main question remains what is the best way for scanning possibly infected external drive (ntfs) in Debian Stretch?
Unfortunately I’d used that sh!t drive on my main Debian just before the conversation – I read my files.
And I unfortunately ran my live debian also with that drive plugged in (and checked my secure mail probably to), so in the case of keylogger etc. I'm also lost, I suppose.
So what I want to do is to check my external drive. Next I probably should check my two debian hosts (one without gui) and finally my live debian (maybe even change all passwords, including encrypted partitions lvm etc.). So my question is what is the best (not necessary the fastest and simplest) way to clean all of this up. Of course I would sudo shred everything and build from scratch - and I am ready to do this - but this is not the most elegant way of doing things for me. And maybe this is a good moment to go further and learn some more important things.
I read about clamav but I got back my fingers from the mouse after seeing some amazon(?) strings linked to the main site.
And I wonder about (for future use) wheter is there any secure way for opening suspicious files in the, let us say, some kind of laboratory like fully (physically) isolated (perhaps encrypted like my debian lvm partitions, for instance) place on the hd or something like that. Probably the best way would be just having one host without wifi firmware for doing that kind of things. I am aware about VM, but this is not looking enough secure for me and my cpu's do not support virtualisation, so making two virtualisations (one for boosting cpu and another for host) seems to be a little bit strange for me.
Thanks a lot in advance!