Hard Drive Infected with Virus, Best way to disinfected w/out infecting my system??

[Viper69]

I have a good sized Seagate hard drive, about 300gigs, IDE. It has MS Windows XP Pro SP2 installed on it. It used to be my original C drive. It got infected with something so bad, that I could never quite get it working properly. The virus/malware was too far embedded, I could never find the source of the problem. It caused a fake process to appear over and over and brought my system to a stand still. In any event, I pulled it out..and just kept it.

My current drive in my rig, has C partition (proggies and OS) and E partition (storage). I have Kaspersky v8.0.0.56 for anti virus software.

I'd like to just reformat the infected, drive, and use it as an external drive. Is this possible? Will reformatting really turn every sector back to zero's and one's. I just don't want to get infected again.

How do I go about connecting it to my computer, w/out infecting my system?? I cannot have this infection happen again.

Second, my current, working external drives when they are turned on, automatically mount too, as they should. I believe a little a box pops up and goes through all the folders. But I don't believe the box is related to KAV. I think it's just some MS OS feature.

In any event, how can I salvage this infected drive without infecting my hard drive now???

Any help appreciated.

Thanks in advance.

[TimoneX]

DBAN that suckah:

http://www.dban.org/

I'd probably ensure that all HD's were disconnected from the host computer save the offending one, boot off the DBAN image and nuke the drive. That will get rid of everything, but if you want that extra piece of insurance you can always schedule a boot time AV scan too.

[cmichaelt]

I'd like to just reformat the infected, drive, and use it as an external drive. Is this possible? Will reformatting really turn every sector back to zero's and one's. I just don't want to get infected again.

How do I go about connecting it to my computer, w/out infecting my system?? I cannot have this infection happen again.

Go to this website: http://www.dban.org/download (http://www.dban.org/download) and download whichever version of your choice (floppy or cd/dvd). Turn off your computer and unplug ALL HARDDRIVES (IDE and USB connected). Plug in the INFECTED hard drive only. Pop in which ever version of the program you downloaded and there will be some options. i would do only 1 pass since all you want to do is clear everything. The program is a stand alone so no OS needed.


Second, my current, working external drives when they are turned on, automatically mount too, as they should. I believe a little a box pops up and goes through all the folders. But I don't believe the box is related to KAV. I think it's just some MS OS feature.

Yea this is just MS scanning through the contents possibly caching it for search and indexing.

[cmichaelt]

You beat me to it TimoneX.

[TimoneX]

<----- Quick draw! :beer:

[jediman]

BURN IT!!!!

[Viper69]

Thanks guys...That's what I'll do

[tinymouse2]

Completely agreeing with everyone, DBAN is the way forward. A couple of passes should completely nuke it.

[prime81]

The other simple thing to do would be disconnect all other drives and put the infected one in, boot to a windows install cd and format the drive. Unless your trying to save information on the drive this is what I would do. Just make sure you do the actual format and not the quick format option.

[athlonhead]

You can also download seatools from the seagate web site and do a zero write to it.
Their version of disc wizard will do it too.

http://www.seagate.com/www/en-us/support/downloads/seatools

http://www.seagate.com/ww/v/index.jsp?locale=en-US&name=DiscWizard&vgnextoid=d9fd4a3cdde5c010VgnVCM100000dd04090aRCRD

[kkpudge7]

Will reformatting really turn every sector back to zero's and one's.

I know your question has been answered, but I just wanted to clarify on this point for the sake of information security, for those who might stumble on this thread in the future. No, formatting the drive does not zero fill the entire disk, it simply re-writes the file system, in your case it was NTFS (windows xp). In doing this, alot of the metadata about the file will be gone (the MFT entry for the file) but the file will still be recoverable off of the drive. If you are concerned at all with the security of the information on the drive, a tool like those mentioned above need to be used to 'scrub' or zero fill the entire disk.