My old laptop is possibly infected. But I just want to transfer documents that I have created like Excel or Word files. Is it possible that malware entered into these files making it dangerous to transfer them into my new laptop? Also, can a pendrive get infected when it's connected to the infected laptop? Is it safer to send the documents online (like Droppbox or via email)?
asked Mar 3, 2020 at 18:05
-
20Surprised nobody has suggested that the safest thing is to try to pull the files off of uninfected backups– D. Ben KnobleMar 4, 2020 at 13:09
-
34@D.BenKnoble There is 0 indication of a backup so that might be why. And even if there was, how would you know its not infected?– EpicKipMar 4, 2020 at 13:43
-
2@D.BenKnoble It could be a good reason yes. It also depends on how precious the data is, be that monetary value or sentimental value. If the data has no real value beyond needing it (lets say install files to a game) you won't have to back it up of course.– EpicKipMar 4, 2020 at 13:59
-
4Or instead of scanning, perhaps you could use an independently-created office suite on that different OS to copy the visible contents into a set of new files, and then nuke the old files along with the infected system.– AaronDMar 4, 2020 at 19:37
-
6@AaronD wrote "Malware is usually OS-specific". While this is true, it can also be specific to commonly used software such as Microsoft Office, which can be installed on a range operating systems.– End Anti-Semitic HateMar 4, 2020 at 20:28
|
Show 5 more comments
11 Answers
Yes, malware can infect user-created files. Yes, pendrives can get infected when inserted. And it doesn't matter how you transfer them, they will still be infected when they arrive.
You want to scan the files and the pendrive before actually accessing the files.
answered Mar 3, 2020 at 18:11
-
33Note that it might be worthwhile to wait for a bit before scanning, virus scanners may need a little while to update and addnew malware to their list.– ThijserMar 4, 2020 at 7:27
-
4Scanning isn't enough, some advanced malware can hide in the usb stick's firmware. I would throw away any usb drive that's been in an infected computer. wired.com/2014/10/code-published-for-unfixable-usb-attack Mar 5, 2020 at 13:30
-
4
-
1This is why CD burning and floppy drives should never have faded into the sunset. No firmware on discs and disks, so you can scan 'em without worrying that something's still lurking within (other than bugs without known signatures). Mar 6, 2020 at 21:42
-
2
Yes, it’s possible to infect MS Office (MS Word, Excel,...) file-type files with malicious macros. The HTML files could be infected with malicious JavaScript. There’s a possibility that your endpoint/antivirus software doesn’t clean fully those malicious JavaScript and macros from the infected files so manual inspection/cleanup is needed or you should restore from your clean backup files.
Any writable pendrive could be infected with malicious code or have its files infected when it's connected to infected laptops.
It's safer to send documents online via Google Drive or Dropbox because when files are viewed online, malicious code could not be automatically executed and you could restore files from the service's backup.
answered Mar 4, 2020 at 6:11
-
17Note that Google Drive or Dropbox will usually not remove macro viruses from MS Office documents. But if you only care about the content of the documents and don't require the files to be exactly the same, then it should be pretty safe to copy&paste the text of an MS Office document into a Google Docs document and then open that Google Docs document on a different computer.– PhilippMar 4, 2020 at 12:25
-
3Google Drive or Dropbox will probably not remove viruses from your files. Mar 4, 2020 at 12:37
-
13@Cruncher From a quick search of "what can malicious microsoft word macros do", we get Macros Explained: Why Microsoft Office Files Can Be Dangerous, which has, among many examples: "For example, macros can use the VBA SHELL command to run arbitrary commands and programs or use the VBA KILL command to delete files on your hard drive." So no, it's not even close to sandboxed.– Davy MMar 4, 2020 at 18:15
-
4@Cruncher It is a big security topic. I always recommend to disable all macros and JavaScript execution in every application unless you really need it. This includes, but is not limited to, "office" applications and PDF readers/editors. Most software comes with this functionality enabled by default, which is a bad practice when it comes to security. Mar 4, 2020 at 20:41
-
4@Cruncher As for why it exists: it was designed in the distant past, when viruses weren't a big deal. Mar 4, 2020 at 20:42
When I need to view data from a system I know (or think) is infected with malware, I convert the data to plain text files and only view the resultant data with viewers that do not interpret the data (simple text editors and hex editors).
This technique, of course, is much easier with certain data types than others.
Although malware scanners are helpful in finding some malware, they can only find malware that they are programmed to find (typically using signatures or heuristics). Just because malware scanners say a file is clean does not mean it is clean. It just means the scanner was unable to find any suspicious code.
Malware scanners are not good at finding unique malware; they are only good at finding common malware and malware that follow a certain set of predefined behaviors.
answered Mar 4, 2020 at 20:36
Yes, there is a risk that the files themselves, or the thumb drive you transfer them with, will be infected. If you are willing to take the risk, there are a few precautions you can take when moving the files to your new system:
- Don't boot up the infected operating system. Instead, boot from a bootable thumb drive when you transfer the files. This reduces the risk that the thumb drive gets infected. To reduce the risk even further, follow Josiahs suggestion and don't use the same OS on the thumb drive as on the infected computer.
- Run the Office files through some software or service that removes all macros before opening them. Also, make sure that they all ends with x (e.g. .docx or xlsx) and not m (e.g. docm or xlsm) or nothing (e.g. doc or xls) since the first forbids macros while the others don't.
- Scan the files with multiple different anti-virus software.
- The safest option is probably to follow Minh-Triet Pham Tran's advice and copy paste plain text into a Google document or similar. This might get impractical, though.
Even if these steps reduce the risk, they do not eliminate it. If you have backups, it would be much safer to restore the file from these. Or not at all.
Usually, common malware requires a startup of OS, because usually, malware embeds or writes itself into a startup elements. However, with the so many different types of malware at large, it would be still a good idea to first perform a scan of everything involved in restoration procedure.
As above, it's a risk. If it's not a lot of docs and you don't have an easy way to scan, you could load them someplace like Google docs first and download from there, or just copy text to Google docs and then copy text back.
-
4Unfortunately, the malware can intercept credentials used to upload to file sharing service. This is not a good advice. Consider as many vectors of attack when proposing remediation action. Mar 3, 2020 at 21:01
-
2@RashadNovruzov I'm not sure I would give such a broad warning. I would advise to protect against such an attack, but not to suggest that the course of action should not be taken. Use 2FA, use a throwaway Google account to upload, etc.– schroeder ♦Mar 3, 2020 at 21:55
-
1@schroeder Typical user may do mistakes such as first opening a browser with saved session of main account, creating a throwaway account with similar if not identical password, etc. Considering these risks for a typical user, I would advice FIRST to scan, THEN to send files, as opposed to what a contributor proposed. Mar 4, 2020 at 12:08
-
2@RashadNovruzov ... right ... so the advice should be to remind people about the threats and how to more safely carry out the advice rather than saying "This is not a good advice because bad things can happen."– schroeder ♦Mar 4, 2020 at 12:17
Only an issue if:
- The file was the source of the infection
- the infection was designed to spread
If the files you are transferring don't contain sensitive information, you can copy them into a zip file and then drop the Zip file into virustotal.com and it will let you know from 60 scanners if it detects anything.
That should give you a peace of mind if nothing is detected.
If the documents have personal or sensitive info then do not place in the Virustotal website.
In addiiton to Schroeders good answer: One point is of outmost importance if you use the method you suggested:
Also, can a pendrive get infected when it's connected to the infected laptop? Is it safer to send the documents online (like Droppbox or via email)?
If you are doing this from an malware infected laptop / PC there is the possibility that you are making the problem even worse!
- Some malware use active internet connections to download even worse malware and start it on your pc.
- Some malware use active LAN connections to infect other PCs/Laptops in your LAN!
- If you upload the infected files via mail, dropbox, ... while having booted from the infected OS. Then depending on the malware in question it can easily be that your passwords get compromised the very second you type them in, or log into dropbox, ... .
Thus I would not plug the possibly infected laptop into any WIFI/LAN/Inet if avoidable, as you can increase the severity of your problems a lot (depending on what type of malware has infected the laptop).
You can open the old documents on the infected laptop and resave in TXT/HTML/CSV format that won't have issues with active content (barring anything like JS being inserted to the HTML doc). Then inspect the documents in Notepad to check they're OK.
Regardless of whatever path you use, the basic thing you need to keep in mind that you are trying to eliminate any embedded executable code that can infect the target system when the file's corresponding program opens it. Uploading to Google drive or dropbox only helps to extent they have effective virus checks for files of that program.
Safest bet is to either convert whatever you can to ascii .txt or csv so that you eliminate all possible embedded code.
But if you have files like html pdf doc xls etc, then you want to use an up to date virus scanner program to check and clean the files before transferring them:
Use a transfer mechanism like Google drive or dropbox to avoid any risks with the USB drive, and then copy files to target system (zero risk in doing that as executable statements in files can activate until you open them in a program that reads their format). Then scan the files with your up to date virus scanner. Once checked/cleaned you should be fine to open the files for all practical purposes.
If you don't know what malware infected your old laptop, you have no basis to trust or distrust anything you salvage from it.
