Virus propogation from old HD(moved from Virus/Trojan/Spyware Help)

Warbird419 · 06-29-2009, 08:13 AM

My brother asked me to help him with his PC- he said it had a virus and was running slow.

I went for a full rebuild: I got a new HD, pulled the old HD, installed the new one and reinstalled Windows.

Now my brother wants some pictures he took that are stored on the old hard drive. I have an IDE-to-USB adapter, so I know I can access the drive, but here is my question: can a virus move itself from the old hard drive to the new simply by being plugged into new machine? Also, could the virus have infected the picture files, and could moving them to the new machine re-introduce the virus onto the new HD.

I have AVG free running on the new PC.

tetonbob · 06-29-2009, 11:36 AM

Hi -

Have a read in this post I made previously, some of it applies

http://www.techsupportforum.com/secu...ml#post2124326

To try to answer your specific questions...

It depends on what the infection was. If it was a pe file infector or an autorun worm, then yes, just connecting the drive can cause crossover, once the Windows partition on the new hdd is loaded. Disabling autoruns on the new install can help prevent that.

Picture files are not generally infected, though. The best way to tell is to mount the old hdd to some machine, and scan it....or scan it from within a Linux/WindowsPE bootdisk environment before reintroducing them to the new install.

Since you've just reinstalled Windows, and not had a lot of time to add to the new install, now would be the time to experiment. If something goes south, not as much is lost as would be if you tried to restore the pics later on down the road and found the old drive caused new drive to become infected.

Warbird419 · 06-30-2009, 11:43 AM

Could I use a "live CD" like BartPE to safely move the pic files?

I would think since the bare-bones OS isn't running off the hard drive, viruses would be less apt to effect the HD's.

tetonbob · 06-30-2009, 12:35 PM

That should be feasible, and one of the options I meant when I said "from within a Linux/ WindowsPE bootdisk environment". I'd still run some sort of scan on any files before I moved them to a fresh install.

06-29-2009, 08:13 AM	#1 (permalink)
Warbird419 Registered User Join Date: Sep 2007 Posts: 15 OS: XP & Vista Premium	Virus propogation from old HD(moved from Virus/Trojan/Spyware Help) My brother asked me to help him with his PC- he said it had a virus and was running slow. I went for a full rebuild: I got a new HD, pulled the old HD, installed the new one and reinstalled Windows. Now my brother wants some pictures he took that are stored on the old hard drive. I have an IDE-to-USB adapter, so I know I can access the drive, but here is my question: can a virus move itself from the old hard drive to the new simply by being plugged into new machine? Also, could the virus have infected the picture files, and could moving them to the new machine re-introduce the virus onto the new HD. I have AVG free running on the new PC. Last edited by TheBruce1; 06-29-2009 at 08:53 AM.

06-29-2009, 11:36 AM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,735 OS: 2000 Pro; XP Pro; XP Home	Re: Virus propogation from old HD(moved from Virus/Trojan/Spyware Help) Hi - Have a read in this post I made previously, some of it applies http://www.techsupportforum.com/secu...ml#post2124326 To try to answer your specific questions... It depends on what the infection was. If it was a pe file infector or an autorun worm, then yes, just connecting the drive can cause crossover, once the Windows partition on the new hdd is loaded. Disabling autoruns on the new install can help prevent that. Picture files are not generally infected, though. The best way to tell is to mount the old hdd to some machine, and scan it....or scan it from within a Linux/WindowsPE bootdisk environment before reintroducing them to the new install. Since you've just reinstalled Windows, and not had a lot of time to add to the new install, now would be the time to experiment. If something goes south, not as much is lost as would be if you tried to restore the pics later on down the road and found the old drive caused new drive to become infected. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009

06-30-2009, 11:43 AM	#3 (permalink)
Warbird419 Registered User Join Date: Sep 2007 Posts: 15 OS: XP & Vista Premium	Re: Virus propogation from old HD(moved from Virus/Trojan/Spyware Help) Could I use a "live CD" like BartPE to safely move the pic files? I would think since the bare-bones OS isn't running off the hard drive, viruses would be less apt to effect the HD's.

06-30-2009, 12:35 PM	#4 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 35,735 OS: 2000 Pro; XP Pro; XP Home	Re: Virus propogation from old HD(moved from Virus/Trojan/Spyware Help) That should be feasible, and one of the options I meant when I said "from within a Linux/ WindowsPE bootdisk environment". I'd still run some sort of scan on any files before I moved them to a fresh install. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Because what you don't know, CAN hurt you. Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Microsoft MVP - Consumer Security 2009