Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected Backup cleaning from a clear computer


  • Please log in to reply
5 replies to this topic

#1 Kierg_Catta

Kierg_Catta

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:51 PM

Posted 17 February 2015 - 06:14 AM

Hello,

My computer was infected with an unknown malware  that didn't allow me to search on common websites as google or youtube while allowing free connection to all other websites through an unknown proxy, plus other symptoms

 

I tried to search for the problem with malwarebyte anti malware, avast, emisisoft emergency kit, spybot, they did not identify anything. I'm also 100% sure that the problem was inside the computer, not a browser problem, not a network/router problem.

Since backup + formatting takes me much less effort than cleaning up an already clumsy, now infecter computer, i saved every data that has to be saved on an external hard drive, then i formatted the computer.

My question is:
Since the backup may be infected with the same malware - that i have NO idea how i got it, so  NO idea on how it infects other PCs, how can i clean the backup from another Windows installation without infecting it when i plug the hdd in? which precautions, tools, should i use? How should i proceed, since my actlal knowledge failed me?

 

Available instruments:

-One clean PC (windows 8.1)

-One formatted PC, with fresh Windows 7 installation - the one on which i have to restore data

Both computers can be booted from DVD and USB

 

-multiple empty DVDs for bootable distros (if needed)

-1GB USB drive for bootable software

 

-1TB USB3 external backup HDD probably infected - that needs cleaning

 

Any help would be appreciated :)

 

Davide

Edit: i used Search button - couldnt find any topic relevant


Edited by Kierg_Catta, 17 February 2015 - 06:15 AM.


BC AdBot (Login to Remove)

 


m

#2 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:05:51 AM

Posted 17 February 2015 - 07:26 AM

If you disable autorun it will stop malicious programs jumping to your clean computer from your backup drive. You can copy personal docs and pics over, but all program files and settings files are risky.

 

Here is a tutorial on how to disable autorun.

 

or you can copy this into any new text file and rename it anything.reg, double click it and OK.... autorun for all drives will be disabled.

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoDriveTypeAutoRun"=dword:000000ff

Once you have recovered your personal data you can reformat the drive to clean it.



#3 Kierg_Catta

Kierg_Catta
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:51 PM

Posted 17 February 2015 - 09:41 AM

What about programs and settings? is there a way, with an array of scanning programs, to be reasonably sure they are not infected? time and source availability are a problem to retrieve some of them back, and if i infect my newly formatted PC i can reformat it again.



#4 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:05:51 AM

Posted 17 February 2015 - 04:02 PM

Determining whether or not programs and settings are infected would be a manual research task. Scanners would not be comprehensive other than to give you a list of possible entries, but understanding how these entries relate to potentially malicious software requires training. You always have the option of restoring the HDD to your PC and starting a thread in the malware removal logs forum, to request help from the malware removal team. Please note there can be some delay when requesting help, due to the high demand and the volunteer basis of the helpers.

 

Just to note, that objects like saved game files can also be transferred safely.



#5 Kierg_Catta

Kierg_Catta
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:51 PM

Posted 18 February 2015 - 07:17 AM

I will restore the files i most need. If i will see any symptoms i'll make a thread on the malware removal section.
Thanks for help :)



#6 TsVk!

TsVk!

    penguin farmer


  • Members
  • 6,230 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:The Antipodes
  • Local time:05:51 AM

Posted 18 February 2015 - 03:45 PM

You're welcome :thumbup2:






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users