If I had a possibily infected computer, where I had some images and documents that I wanted do backup to a thumb drive, is it possible that that the used thumb drive could be infected and when connected to other computer, infect that computer in the process?


The way you phrased your question implies a basic misunderstanding, or perhaps I’m being pedantic, so bare with me.

In general media devices like thumb drives are not themselves infected, rather it’s individual files on the media that may be infected.

This ignores device firmware rewrites, but that is very low probability in most cases.

The crux of the risks are the files you are moving. They may contain the malware and placing them on another machine may transfer the malware to that machine.

With normal modern configurations, there should be no automatic running of code simply by plugging in the thumb drive, although you may get a pop up asking you to do so to which you should obviously decline.

The big risk is from the files. While there have been a few exploits that managed to leverage data content only such as images via flaws in readers, these are rare. The more common threat is executable files. The catch here is that it’s sometimes difficult to know what is executable. Many “Documents” such as MS Office or PDFs can contain executables. These are you primary vectors for malware transfer.

The thumb drive itself can be sufficiently cleaned up with a long format (not a quick format).

| improve this answer | |
  • How common are firmware rewrites as a way to spread a infection? – zinnks Jul 28 '19 at 10:20

Well until and unless you know what the malware performs by reverse engineering it you can never really know what it might do.Right?I mean a malware could simply wait for the victim to attach a USB device then copy itself onto it.When it comes to malware the realm of possibility is kind of limitless.So if you know a computer is infected you might want to use other techniques like a LINUX live boot or attach the hard disk and then copy data from there.Executing the malware might not be a good idea and Booting might do that

| improve this answer | |

Would you like to backup possible altered data, to use that as correcting option to your clean environment?

If yes, you can think about a new compromised pc, the attacker can install stuff that was dragged to your system from the backup and once the malicious incoming connection has reached a place in a memory address of your pc during the backup process, its killed.

If no, you have no risk because you have more than one backup(or that's how it should be), top of the cake is another backup that is on another network.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.