1

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have programs and all of my files. If I boot from Linux to save whatever I can save, what should I save and what should I be careful about completely deleting?

I guess all executables are better deleted as a malware with control of the system could've replaced them with malicious versions? And what about other kind of files?

In particular I'm concerned about my emulators and ROMs of retro consoles. I'll probably delete all the emulators, but are ROMs at risk? Can they easily be corrupted to become malicious software?

And in general, can I keep documents, videos and music?

And if any executable slips through and I don't manually execute it, could it cause any damage?

2

I'm quite sure my Windows PC is infected beyond salvation and I want to format it and reinstall everything. However, I have a 128 GB SSD where I keep only the OS and a 1 TB hard disk where I have programs and all of my files. If I boot from Linux to save whatever I can save, what should I save and what should I be careful about completely deleting?

If you have backups from before you got infected that could not be accessed by this system after it became infected, just nuke everything and restore from those. If not, continue reading.

I guess all executables are better deleted as a malware with control of the system could've replaced them with malicious versions? And what about other kind of files?

Office documents and PDF's are the big ones to make sure and remove. Both of them are pretty actively used attack vectors, and just loading an infected one is quite often enough to compromise the system.

Others include (but are not limited to) JAR files (which are Java executables), any virtual machines you might have on the system (they're probably infected), and anything inside C:\Windows.

In particular I'm concerned about my emulators and ROMs of retro consoles. I'll probably delete all the emulators, but are ROMs at risk? Can they easily be corrupted to become malicious software?

The ROM's are probably safe. While they actually are executable code, they aren't native code and they aren't highly portable, so they're not easy or attractive targets for malware. Unless you can reliably determine that you were infected through one of them, you can probably safely assume they are not infected.

And in general, can I keep documents, videos and music?

Documents other than plain text files should probably be wiped. Videos and music may or may not be safe to copy over, they're not hugely common attack vectors (so the same argument as used for ROM's (if you can't determine that you were infected because of them, they're probably safe).

And if any executable slips through and I don't manually execute it, could it cause any damage?

If you're doing this right, no executable files should remain from the old system, at all. This is not a case where you should be using the built-in factory reset provided by Windows, you should be wiping the drive and doing a clean install from installation media (which should be prepared on a separate system if you need to create it). In an ideal scenario, you should actually get a completely new system (or, at least, a new motherboard, CPU, RAM, hard drives/SSD's, and any add-in cards), not just reinstall, because you can't be sure the firmware isn't compromised.

Also, when copying out old data, make sure you copy just the file contents and filename. If you copy things in a way that preserves any further metadata, you run the risk of accidentally copying contaminated data (malware likes to hide in NTFS alternate data streams).

  • I thinking suggesting a whole new system (motherboard, CPU, RAM, etc pretty much amount to a completely new computer) is a bit overboard. Yes, malware persisting on firmware is possible. However, it is (IMO) rare, and replacing the entire computer after a virus infection is a bit too expensive for your average user. Just because it is possible doesn't mean it is likely, or should even be the first concern. Now if you completely wipe everything and immediately get reinfected on new install... well maybe then... – Conor Mancone Oct 30 '18 at 20:09
  • To be clear, I was with you up until that last part. – Conor Mancone Oct 30 '18 at 20:09
  • @ConorMancone Yeah, I'm probably a bit paranoid compared to most people. I actually have dealt with infections that got all the way to firmware on at least two occasions though, once with a compromised SD card, and once with compromised firmware on a mainboard (though having looked at the firmware interfaces for another system with the same mainboard, it was trivially easy to infect), so I'm probably an unusual case. – Austin Hemmelgarn Oct 30 '18 at 21:20
  • The problem here is that I don't really know when I got infected, it was probably via torrenting or via pdf documents. It's really a bummer that you can get infected though .docx and .pdf files, wouldn't have expected that. I even knew readers like the browser ones use sandboxing. A lot of important stuff I have are documents or pdf files, it will be a pain to delete them all. Should I only be concerned about the dubious origin ones, or could the safe ones have been infected too after the malware took over? And is there a way to safely open them to check the contents before wiping everything? – Eärendil Baggins Oct 31 '18 at 2:57
  • About PDFs, it looks like you can disable scripts from execution on most readers, does that make them safe to open? And can you do the same on office documents? – Eärendil Baggins Oct 31 '18 at 3:09
1

In general - yes, malware can infect executables, libraries and scripts. Malicious scripts could also be included in supported types of documents like docx or pdf. Malware could also affect archives, it even can reside in alternate data streams. Images could also contain scipts in EXIFF section, that could be executed by viewers or other processing software.

ROMs are unlikely to be affected, but in theory, it's possible to use them to execute malicious code via emulator.

If you don't manually execute a program, it still could be executed by scheduled jobs, autostarts/autoplays, or chain-loaded by other software/script.

So the main advice here is - use the least privileged account for everyday work/entertainment, pay attention to UAC questions and check suspicious files with virustotal.

  • How can I bulk remove EXIFF sections from images? And can image viewers be configured in order to not execute them? How does the Windows image viewer behave by default? It seems so stupid to have such a huge vulnerability in something as trivial as an image... – Eärendil Baggins Oct 31 '18 at 3:21
  • Also can you provide some link about exif files containing scripts? From what I can find they only seem to contain metadata – Eärendil Baggins Oct 31 '18 at 3:24
  • @EärendilBaggins here's an example: medium.com/0xcc/… – odo Oct 31 '18 at 10:16
  • this looks like an issue with images being opened on a server, but is there a way to bulk remove exif data? I have a lot of images and manually doing the windows/gimp thing is impossible. – Eärendil Baggins Oct 31 '18 at 10:35
  • There are tools like exifpurge.com but mentioned vector is unlikely to be exploited this way unless you run a some kind of local web server. – odo Oct 31 '18 at 11:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.