How to Disinfect a Hard Drive?

[crossbone]

I'm afraid my hard drive is infected and I've decided it's now a good time to reinstall Windows XP pro(somehow, the anti-virus I have can't fix it). I know formating the drive won't get rid of the virus, so is there any way to disinfect it? heard about data dump softwares, but how well does it work?
thanks!

[Paul Komski]

I know formating the drive won't get rid of the virusFormatting wont remove the underlying data but should render it inaccessible and thus completely harmless. If you want to go to the extreme of zeroing or wiping partitions you can use utilities such as eraser or the disk manufacturers' own utility - but that shouln't be necessary.

Formatting doesnt remove boot sector viruses though writing a new MBR with fixmbr from an NT-RecoveryConsole or fdisk /mbr from DOS (but backup your data first) or other utils that will write standard MBR code should clean them up. Partition boot sector viruses can be removed with fixboot from an NT OS or by sysing a FAT partition. Nor does formatting remove CMOS or firmware viruses but these are extremely rare.

For nearly all run-of-the mill viruses formatting suffices but zero the whole drive if in doubt. Hard boot (from a turned-off computer) after cleaning up since it is not unheard of for stuff to lurk in RAM.

When accessing systems with boot sector viruses with floppy diskettes - always use known clean ones and write protect them or you will simply get reinfected.

Disconnect for an infected network and install an appropriate antivirus or patch to prevent reinfection unless the network is known to have been disinfected or you will simply get reinfected.

[crossbone]

afraid i'm still kinda lost here. let's assume i'm a pc dummy

[PrntRhd]

crossbone,
I think Paul is saying the wipe/reload method is effective, but that is the "nuclear option" in computer repair, you lose all your settings and data, all your product keys, the works, then you have to reload everything from scratch.
You could even pay the "Geek Squad" guys to do that for you.
You have not posted the errors you are getting from the infection so we cannot base any advice on any more than reasonable guesses, some infections are Java ByteVerify exploits, some may be much more serious.
If you want to try to clean the PC, try posting a HiJackThis log so we get some idea of the issues.
http://www.merijn.org/programs.php#hijackthis
Download the HJT, unzip it into a new folder on your drive and scan/make a log. Copy/paste the log into a new thread in Applications&Security forum here.
Once started, you should follow through until the PC is declared clean.

[Paul Komski]

More Simply

If in doubt then wipe the whole drive having first backed-up any data you cannot afford to lose. DBAN (http://dban.sourceforge.net/) should do this very effectively but be warned don't run it on a system with data you might still want.

Deleting and then reformatting partitions will remove all viruses on your hard drive with the exception of MBR viruses (nowadays relatively uncommon) and having deleted all partitions on a hard drive (with say the DOS utillity called fdisk run from an MSDOS boot floppy disk) you can use the same utility to cleanup the MBR by issuing the command
fdisk /mbr

woops 6mins too late! ;)

[mjc]

Let's back up a little...

How are you going to reinstall?

Is the machine in question a pre-built, off the shelf machine (HP, Dell, etc) or a custom made machine?

If it is the former, does it have a set of 'recovery' disks?

If so, then using the 'full' option will restore the machine to factory fresh condition...by totally overwriting everything on the drive, restoring an image of the fresh install...

If not, and you would be using a retail install disk, then I would just to 'be sure' use a utility (even the drive manufacturer's utilities) to 'zero fill' the drive. Then make sure the CD is set to be the first boot device in the BIOS, put in the CD, and reinstall to that..

One advantage of using the drive manufacturer's utilities is that you can also check the general health of the drive...a simple format/reinstall using the MS provided utilities only checks to see if the drive works well enough to install Windows, not if it is really working properly.

[Tyorik]

Sometimes what helps is getting an external enclosure, taking out the infected hard drive, attaching it to another computer and using something like Trend Micro or Kaspersky to scan that particular infected drive. When the files aren't in use by Windows or when Windows isn't active sometimes files can be removed easier. If nothing else exploring the drive through windows and trying to delete it potentially helps.

[Paul Komski]

I had the original impression that crossbone wanted to reinstall windows but was simply afraid that reformatting would not clean up any viruses. If the job in hand is to use an effective a/v then install one having downloaded it on another computer and put it on a CD or flash drive or if going on line is an option do an on-line scan.

Top three from a google (http://www.google.ie/search?hl=en&q=online+scan&btnG=Google+Search&meta=) are:-

Trend Micro - Free online virus Scan
Ease your mind and scan your PC for viruses and spyware. ... to express your appreciation for HouseCall by making a charitable donation to Schools Online! ...
http://housecall.trendmicro.com - 45k - Cached - Similar pages

BitDefender Free Online Virus Scan
To scan just some of your folders, click here. Settings ... BitDefender Online Scanner is a fully functional antivirus product. It features all required ...
www.bitdefender.com/scan8/ie.html - 38k - Cached - Similar pages

Panda ActiveScan – Free online antivirus to combat viruses ...
Scan for threats in e-mail messages and compressed files. Operates online directly from the browser. On demand scanning. Detects ...
www.pandasoftware.com/products/ActiveScan.htm - 36k - Cached - Similar pages

[crossbone]

Let's back up a little...

How are you going to reinstall?

Is the machine in question a pre-built, off the shelf machine (HP, Dell, etc) or a custom made machine?

If it is the former, does it have a set of 'recovery' disks?

If so, then using the 'full' option will restore the machine to factory fresh condition...by totally overwriting everything on the drive, restoring an image of the fresh install...

If not, and you would be using a retail install disk, then I would just to 'be sure' use a utility (even the drive manufacturer's utilities) to 'zero fill' the drive. Then make sure the CD is set to be the first boot device in the BIOS, put in the CD, and reinstall to that..

One advantage of using the drive manufacturer's utilities is that you can also check the general health of the drive...a simple format/reinstall using the MS provided utilities only checks to see if the drive works well enough to install Windows, not if it is really working properly.



mjc,
I have a lappy, dell inspiron 8600, with xp pro disks and other drivers so I think theoretically I'm all set with reinstalling. but I'm not sure about recovery disks. anyway, most of my data have been burnt on DVDs or transfered to external hard drives. the only thing I need to work on are saving bookmarks, passwords in my browser and some actions in photoshop.

[crossbone]

I did the HiJackThis thing and started a new thread here:
http://www.pcguide.com/vb/showthread.php?p=336304#post336304