Formatting hard-drives after Virut attack.

HI,
I've been directed by CatByte to write here and ask for help.
here is the link to the original post:
http://forums.whatthetech.com/Virut_NBM_pl…me_t102165.html


as you can see, I got infected by Virut. the system is pretty much stable at this point giving me time to do things, but its not completely clean. now I need to reformat my hard drives, and backup as much data that I can.
I got two hard drives, one I formatted using this windows (the one that got infected), the other one still contains the windows and some programs, and a partition with the files i want to save. its contains photos (various extensions, most are .jpg .psd. ai), avi files, mp3, wmv, ttf, doc, docx, rtf, pdf, flv, txt etc.
i also want to save some iso, bin and cue files, but i know it may be impossible. so if you tell me I'll delete it.
and what about rar files that don't contains any application?

what i was thinking is to move my files to the formatted hard drive, then disconnect that hard drive and do a full format and reinstalling of windows. then re-connect the hard drives contain the files.

is it safe to do it? to format a hard-drive using an infected windows (by virut)? the formatted hard-drives always contain the folder System Volume Information. I'm afraid it can be infected. how can i remove that folder? I disabled the system restore. and the Recycle Bin for all drivers.

BTW - I have another computer without any hard-drive on it, if that can help. maybe to use it to format the hard-drive, but then when I'll re-connect it to the infected PC it will probably get infected as well. (?)



p.s English is not my native language, so i hope you can understand me.

sorry for the amount of questions.
thanks.

Hi Tomer, welcome to WTT Tech side (the light side, the malware area is the Dark Side ) … You r English is excellent!

Your plan sounds very good to me, but I would format the 2nd hard drive in another computer if possible. If not doable, do you have a Windows XP install CD? If so, I suggest you create a UBCD4WIN CD (Ultimate Boot CD for Windows). This can be done on any XP computer, it doesn't have to be done on yours.

See here for info and directions: http://www.ubcd4win.com/

Once you have this CD, you can boot it and when it finishes, you have Windows XP. You can then use Windows Explorer to format the 2nd hard drive and also copy any data from your 1st hard drive to the 2nd one. The nice part of doing it this way is you are not booting from your hard drive so Virut.NBM has no chance to infect anything.

If you don't have a XP CD, you can try downloading the UBCD (Ultimate Boot CD) .iso file and create a bootable CD from it. You don't burn the iso file itself to CD., you create a CD from the iso file using your CD burning software.

All commercial burner software like Roxio, Nero, Ahead CD support burning bootable CDs from a .iso file. If yours doesn't or your not sure, there is a good freeware burner called DeepBurner which will do this. Another called ISO Recorder is also very easy to use.

I don't think UBCD has the ability to format a hard drive but I may have missed it in the list of tools shown at the web site I gave you. You can use it to copy data from your 1st hard drive to your 2nd hard drive wintout Virut.NBM having a chance to get in though.

One last possibility would be to use a Linux Live (bootable) CD like Puppy Linux to save your data once the 2nd drive is formatted and ready to use. See this post by Happyrck on GeeksToGo for Puppy Linux: http://www.geekstogo.com/…..=findpost&am;…21#entry1197721

Get the latest version available as the one he recommends is no longer easy to find.

Read through what I've suggested then post back with any questions or concerns. If I'm not here to respond, one of the other techs will pick up.

Hi,
option number 3, Puppy Linux, sounds like the most secure and easy way. I've never used a Linux before so I hope I will not mess my files or something. if using a Linux would be too hard for me I'll go with option number one.

I have two important questions:
1. formatting the hard drive while using Puppy Linux makes a clean format? without System Volume Information or any other risky stuff? and what about UBCD4WIN, if I'll format with it, will it make a completely clean and safe format?
2. are you ABSOLUTELY sure that Virut or any other malware I may have on the hard disk (Virut downloaded a "nice" collection of other malwares) will not be able to run, infect other files, or copy it self to the new hard-drive? Virut is a virus that consecutively spread and infect any exe, scr, html (and much more) on the system. so why wouldn't it run with those CD's while ill access the infected files?

Thanks.

1. formatting the hard drive while using Puppy Linux makes a clean format? without System Volume Information or any other risky stuff? and what about UBCD4WIN, if I'll format with it, will it make a completely clean and safe format?

I don't believe you can use Puppy Linux to format a drive for use in XP, especially if you want it to use NTFS, that's why I recommended UBCD4WIN.

You can use Puppy Linux to copy data to the drive once it's formatted.

2. are you ABSOLUTELY sure that Virut or any other malware I may have on the hard disk (Virut downloaded a "nice" collection of other malwares) will not be able to run, infect other files, or copy it self to the new hard-drive? Virut is a virus that consecutively spread and infect any exe, scr, html (and much more) on the system. so why wouldn't it run with those CD's while ill access the infected files?

Yes, I'm sure. Nothing from the Windows drive can run under the Linux OS so there is absolutely no way it can spread the infection. That does not mean that the infection will not be present in files you are copying though. There is no way for me to know what files are or are not infected. That's why it's recommended that you only copy data files and not things like movies (avi, mpeg).

OK, so I decided to back up the important things on DVDs. I bought a nice big pile.

still have more questions:
1. I want to do a complete format using Windows XP CD, the regular not UBCD4WIN. is it safe?
2. I'm sorry for being rude, but I've read here that video files are safe, I have some family related AVI files that i want to save. sorry again but those files are important to me.

thanks.

Tomer, if they are important to you then definitely save them. You can always run several malware scanners against them once they are on DVD.

As for formatting using the Windows Installation CD, yes, that is a good way to go. Don't use quick format though, od the full (long) format. Takes longer but worth the time.

Here is a good tutorial on doing a clean install of windows XP: Clean Install - Michael Stevens Tech

Hi again. I backed up all my files on some DVD's. I really hope they all clean, I checked again and again that I didn't save any file that can contain a virus (using windows XP search). Then i googled things that could help me with my situation, and read some horrifying stories: viruses that can survive format, viruses that can stay in ram, viruses that can infect the BIOS, and so on and on. I've came across some software's like low-level format and DBAN, that supposed to be good with formatting the hard drive, (than I read some people saying that those tools destroyed their HD's ) I had 3(!) Hard-drives connected to the PC while I was infected. Can I format them all at-once (connect them all at the same time) with windows XP installation CD? can't the virus "jump" from one HD to another while I trying to delete it? (sorry if that sounds stupid). Am I being to paranoid? I just want to get rid of this thing for good. thanks.

You will only be able to format your install drive/partition during the XP Install process. I think you are being overly paranoid. Boot the install CD, delete the partition on the first drive, then create a new one, format it and install to it. Once the install completes, open My Computer and format the other two drives. Do a full format, not a quick format.