1

Against my better judgement I foolishly opened an MPEG video emailed to me from a friend's email address because the topic in the email was something we had recently discussed.

I am fairly certain that the MPEG was malware as it only opened Media Player long enough to do some kind of exploit and then closed. Shortly afterwards the Windows Explorer window containing the file closed.

I immediately swore, switched off the PC and disconnected it from the Network and Internet. I then disconnected the SSD D: drive that the MPEG file was saved to and restarted the PC. I ran a full Windows Defender scan and cleared out the Windows temp files.

I suspect that the D: drive has been compromised by a scripting attack and perhaps been encrypted? I have not checked to see if I can access the D drive for fear of making matters worse.

Does my analysis sound correct?

How should I recover from this? Is there some way I can format the D: drive without compromising my system?

Any help will be gratefully received.

Thanks,

Mike

  • Thanks again for any advice that experts are able to offer me. If there is any other information that you would like me to add please let me know. – Mike Poole Nov 6 '14 at 11:42
  • Do you have an emergency boot disk with an up-to-date antivirus scanner on it? – RockPaperLizard Nov 6 '14 at 12:30
  • 1
    Hi @RockPaperLizard, thanks very much for taking the time to reply, it is much appreciated. I do have a boot disc and can add a virus scanner to the disc as well. To clarify I can access the PC that I suspect is infected. My cause for concern is that when I deleted the MPEG from the D drive I could not empty it from the recycle bin (I got an "exception integer division by Zero" 0xc0000094 error). Neither a system restore, nor a rd /s /q %systemdrive%\$Recycle.bin solved this (recycle bin still had file and bin wouldn't open) but I fixed this by adding a file to bin and deleted them both. – Mike Poole Nov 6 '14 at 13:05
  • You're welcome. Is you D drive accessible when you boot from your boot disk, or does it require drivers that are not on the boot disk? – RockPaperLizard Nov 6 '14 at 13:07
  • I can access the D drive when I log into the system normally or when I access it in safe mode. My concern is that it has been compromised and that when I connect the PC back onto the Internet something nasty might happen to the D drive (e.g. malfeasants encrypt the data on it). Is that a possibility if this is an MPEG exploit? – Mike Poole Nov 6 '14 at 13:11
0

If you can access the D drive after booting from your boot disc (which is different from booting into safe mode), then it will be reasonably isolated to scan everything using multiple virus, rootkit, and malware scanners. The only vulnerabilities you will be exposing your system to at that point, it has already experienced.

You can just format the D drive at that time as well. If you want to be extra cautious you can use a format parameter (such as /P:1 or /P:3) that will overwrite most of the sectors on drive D, but that will take a fair amount of time to run.

  • While it is common computer knowledge, it is worth stating that formatting a drive basically erases the data on it. – Jonathan Nov 7 '14 at 21:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.