2

This question already has an answer here:

I have to work on infected websites once in a while, and I'm wondering if there are some good practices to keep my computer safe.

I use my personal computer for work, so I'd like to take precautions.

Is downloading an infected website via FTP a risk only if I run it locally? If not, what are good safety measures I can use to minimize the risk?

marked as duplicate by RoraΖ, TildalWave, Adi, Lucas Kauffman, Rory Alsop Dec 16 '14 at 0:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Depending on the infection, it may not be the same as "comprimised". There are many javascript injections that may happen through vulnerabilities in the code or modifications to the server side scripts done with an unprivileged account which only affects the website but not the entirely system. A compromised system is another story. – lepe Jun 23 '16 at 2:04
4

First of all if you are downloading and running code from an infected website, you basically may infect your machine. So at this point it's time for you to format your computer and reinstall everything.

Second of all when doing incident response (which this basically is) you always start from a fresh build with your tools, either in a virtual machine or on a physical machine, and download the files to your machine. You can then analyze the malware. Afterwards you either discard or store the image. You then copy your clean image again for your next IR. You NEVER re-use the same OS where you already did analysis on.

Also refer to our topic here How do I deal with a compromised server?

  • Thanks. I never ran infected code, though I did edit infected files, but I've formatted just yesterday and have to deal with an infected site now and didn't want to take any risks. I was planning on using VirtualBox + linux OS, that would be sufficient then? I'll keep a clean image of the VM for any other infections I may have to clean. – Shane Dec 15 '14 at 19:49

Not the answer you're looking for? Browse other questions tagged or ask your own question.