Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


How Do I Safely Copy Files From An Infected Hdd?

  • Please log in to reply
3 replies to this topic

#1 mda


  • Members
  • 73 posts
  • Local time:02:08 AM

Posted 29 February 2008 - 02:23 AM

i could not find any references to this topic despite several different
searches, so i want to ask. i'm not even sure this is the right forum
for this, but as this is a prelude to trying to clean the drive...

os- vista business, all windows updates installed, ditto for trend

okay. ran what was supposed to be a patch file to get rid of a nag
screen on a program. now trend pccilliin and windows defender will
not start automatically or manually, and i cannot connect to the

before trying to deal with the virus, i'm creating a new main hdd. i used
my last backup, but it is missing some important files. i want to copy
those files now so while i spend a month or two trying to clean the hdd,
i've got a more-or-less up-to-date pc.

i do not know what the safest way is, though. i thought i might put the
infected drive in a usb enclosure, and the newly-cloned drive in the
laptop, then copy from one to the other, either in normal mode (despite
that the virus protection did not see the virus), or in safe mode with
no virus protection (although there seems to be spyware programs
that will run in safe mode, i've never seen a anti-virus program that will.)

any thoughts?


BC AdBot (Login to Remove)


#2 usasma


    Still visually handicapped (avatar is memory developed by my Dad

  • BSOD Kernel Dump Expert
  • 25,091 posts
  • Gender:Male
  • Location:Southeastern CT, USA
  • Local time:06:08 AM

Posted 01 March 2008 - 07:19 PM

You'll have to use rewritable media of some sort (a flash drive or a external hard drive) - that way you can delete any infected files. If you copy infected stuff to a CD or DVD - you'll just have an infected CD/DVD and won't be able to do anything with it.

Copy everything to this rewritable media BUT do not copy any executables (.exe, .com, .bat, etc)

Do not hook up the copy to any system unless it has a fully functional and updated antivirus and antispyware on it (and it's scanner should be resident in memory when you hook it up). This is a case of some is good, but more is better - use as many scanning tools as you can get a hold of.

As soon as you hook it up to the other computer, run both the antivirus and antispyware scans - and delete anything that's infected (don't quarantine). After that it should be safe for use on other systems (as long as it's a reliable and thorough antivirus and antispyware application).
My browser caused a flood of traffic, sio my IP address was banned. Hope to fix it soon. Will get back to posting as soon as Im able.

- John  (my website: http://www.carrona.org/ )**If you need a more detailed explanation, please ask for it. I have the Knack. **  If I haven't replied in 48 hours, please send me a message. My eye problems have recently increased and I'm having difficult reading posts. (23 Nov 2017)FYI - I am completely blind in the right eye and ~30% blind in the left eye.<p>If the eye problems get worse suddenly, I may not be able to respond.If that's the case and help is needed, please PM a staff member for assistance.

#3 mda

  • Topic Starter

  • Members
  • 73 posts
  • Local time:02:08 AM

Posted 01 March 2008 - 11:20 PM

thanks for the reply. however, it does not seem to have much relevance to
the question i asked. i said nothing about copying infected files, and i did
not ask about what av programs i should have running.

perhaps you meant to say that i should use normal mode with the av program running, and the new drive installed as the system drive, then plug in the infected drive via a usb enclosure and a second hdd or flash drive the same way, and copy from one to the other?

if that is what you said, it does not explain how to then safely copy those files to the new system drive, or explain why i should do it that way rather
than just copying from the infected usb hdd to the new system drive. it also
does not explain why that would be safe, or why i should not use safe

as to using optical media, i do not have an external optical drive, and the flash
drives do not have enough memory at 16gb.


after re-reading your reply, i think i misunderstood what you might have
been saying. i think maybe you were saying i should use the infected
drive as the system drive, and copy from that to a usb flash or hdd. if that
is what you said, i won't do that. if the infected drive is the system drive,
it could infect the usb drive without my knowing it as the virus would certainly be active and the av/as programs i use do not see this virus. and the new
drive i'd plug the usb flash/hdd into will have the same up-to-date av/as programs. also, i do not have a second computer.

Edited by mda, 01 March 2008 - 11:37 PM.

#4 Orange Blossom

Orange Blossom

    OBleepin Investigator

  • Moderator
  • 36,989 posts
  • Gender:Not Telling
  • Location:Bloomington, IN
  • Local time:06:08 AM

Posted 02 March 2008 - 07:15 PM

Hello mda,

What usasma is saying is that you should not directly transfer the files to the new drive. Instead, transfer them to a floppy disc, a flash drive, etc. Scan the living daylights out of the files. If any files are infected, delete them. And make sure not to transfer any executable files.

Orange Blossom :thumbsup:
Help us help you. If HelpBot replies, you MUST follow step 1 in its reply so we know you need help.

Orange Blossom

An ounce of prevention is worth a pound of cure

SpywareBlaster, WinPatrol Plus, ESET Smart Security, Malwarebytes' Anti-Malware, NoScript Firefox ext., Norton noscript

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users