1

I recently fell victim to some Adware (and possible malware). I was installing Firefox and clicked an ad link in Bing and downloaded a "packaged" Firefox install. I believe the ad is still at the top of Bing if you search "Firefox download" right now...

I ran a scan with AVG and a scan with MalwareBytes. Both showed some Adware (about 3 entries total) and those entries were removed. I also installed Firefox from a known, good source and also had to revert a few settings in IE (homepage, default search provider).

However, I am a paranoid person and want to wipe the Windows install on the SSD and start from a clean slate. What is the best way to do this?

Here are the options that I've been able to find:

  1. Do a secure erase via a third party utility and boot CD. This might take some time since I don't currently have either a USB drive I can use to boot from or a CD-ROM drive on a non-infected machine.
  2. Use Diskpart (from Windows 7 install media) to do a clean/clean all. What are the benefits of the clean all versus just the clean? Will any of these operations hurt my SSD? The drive in question is an 850 Evo, so I'm not too concerned about write endurance.

My goal is to start with a 100% fresh drive and Windows install. Also, there's a second drive in the system that I had planned to install Linux at a later date. It should be totally unformatted and in factory new condition (Windows never saw the drive come up when you clicked on "Computer"). Do I have to follow similar steps for wiping on that drive as well?

Thanks in advance for the help.

7

If you're trying to eliminate malware, a simple format is sufficient.

Zero-wiping the disk or repeated over-writing with fancy patterns is about preventing humans from using advanced data-recovery techniques to read the data. There's nothing magical about a pattern of bits that makes it malware, it's the structure surrounding it: the directory entries pointing to the files containing it, the fact that it's marked as executable code, the registry entries for running it, and so on. Eliminate all that, as happens during a format, and it's just a harmless pattern of bits.

  • Thanks for this. So a simple diskpart clean and a Windows install on the affected drive should suffice? I don't have to worry about the other drive (currently marked as unallocated space)? – It'sPete Apr 6 '15 at 21:35
  • 3
    Right. If the other drive is unformatted, the malware would not have even been able to see it. – Mark Apr 6 '15 at 22:04
0

In addition to what @Mark said about formatting your hard drive, you should format the Master Boot Record as well. It's very unlikely that your adware was that insidious, but better safe than sorry. To format MBR in Windows Vista / Windows 7, use bootrec.exe in Windows Recovery Environment:

bootrec.exe /FixMbr

Here's more info on Bootrec.exe

Similar question on SuperUser.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.