FedericoPacheco

New Member
Hi,

My PC has two internal hard drives, an SSD and an HHD (and an external SSD). If I got malware inside of my computer will it affect both drives? I know I can clean the SSD where my OS and apps are by performing a reinstallation of windows 10. But my data drive, will it be infected as well? How can you clean that drive of malware? If I backup data to anorher drive, wouldn't I be backing the malware with it?
 

ItsReallyMe

Level 5
Hi,

My PC has two internal hard drives, an SSD and an HHD (and an external SSD). If I got malware inside of my computer will it affect both drives? I know I can clean the SSD where my OS and apps are by performing a reinstallation of windows 10. But my data drive, will it be infected as well? How can you clean that drive of malware? If I backup data to anorher drive, wouldn't I be backing the malware with it?
yes you will backup the malware too.
 

Spawn

Administrator
Verified
Staff member
You need Ransomware Protection, which can block actions by untrusted* processes from tampering protected folders/drives.

Windows 10 has Controlled Folder Access.
Or, look at the Kaspersky Anti-Ransomware tool.

If you have Microsoft 365 subscription, OneDrive offers some ransomware protection against file changes.

*Unless allowed.
 
Last edited:

FedericoPacheco

New Member
It can get infected.
Thanks

yes you will backup the malware too.
Then, the only way is to loose data? To be completely clean.

You need Ransomware Protection, which can block actions by untrusted* processes from tampering with protected folders/drives.

Windows 10 has Controlled Folder Access.
Or, look at the Kaspersky Anti-Ransomware tool.

If you have Microsoft 365 subscription, OneDrive offers some ransomware protection against file changes.

*Unless allowed.
Thanks

Don't leave your external drive plugged in when not being used to back up, or that will probably be infected at the same time as your internal drives should you get malware - Of course the idea is not to get infected in the first place :)
What if it has been connected all the time? Do I need to loose all the data to be completely clean?
 

MegenM

Level 2
Yes. Even I experienced a similar situation.

I had copied the data from my infected disk to a new SSD. To my surprise, Bitdefender, which is my primary antivirus, detected malware on the newly copied disk as well. Bitdefender automatically took action for the detected malware.

So, what I did was run a full disk scan and completely disinfect the new disk. Also, in order to save time, I formatted the old disk as it was infected.
 

FedericoPacheco

New Member
Yes. Even I experienced a similar situation.

I had copied the data from my infected disk to a new SSD. To my surprise, Bitdefender, which is my primary antivirus, detected malware on the newly copied disk as well. Bitdefender automatically took action for the detected malware.

So, what I did was run a full disk scan and completely disinfect the new disk. Also, in order to save time, I formatted the old disk as it was infected.
My concern is that if you're able to disinfect the new drive, couldn't you be able to disinfect the old drive without formatting? Furthermore, if it's not possible, isn't it possible that the new drive cannot be completely disinfected even if you think you did?
 

struppigel

Moderator
Verified
Staff member
Hi,

My PC has two internal hard drives, an SSD and an HHD (and an external SSD). If I got malware inside of my computer will it affect both drives? I know I can clean the SSD where my OS and apps are by performing a reinstallation of windows 10. But my data drive, will it be infected as well? How can you clean that drive of malware? If I backup data to anorher drive, wouldn't I be backing the malware with it?

Hi,

The short answer is:
Yes it can happen, but it depends on the type of malware.

The long answer:
The majority of infections resides on the drive the operating system is on. Malware very commonly uses the registry to autorun and will put their file copies on the system drive to persist. For those kinds of malware it is enough to only reinstall the OS. Even if it is a ransomware infection, it will in most cases "just" encrypt files on all the attached drives, but not create any infectious files there. Meaning: Those files are encrypted or ransomnotes, but in most cases completely harmless.

There are two types of malware that spread to other drives: Viruses (in the sense of "file infectors") and worms.

Viruses attach themselves to other files, turning them into malicious files which are also infectious. Those files would be backed up if you copy them to another drive. Worms that spread via drives will often place themselves alongside of the legit files on the disk and trick the user into executing them.
Viruses are usually not something your system gets infected with if you have an AV and follow common security practices because they are often old and well-detected by AV software.
Drive worms are more common and may also infect systems with an up-to-date AV.

Last but not least: You may also have a trojan and not recognize it as such and do the mistake of backing it up to the drive. That's a program that seems legitimate but has a malware attached to it. It doesn't necessarily infect other files or the drives, but everytime you run the supposedly legit program it will infect the OS again. This happens commonly with beloved adware installers and cracks where the users of those programs refuse to acknowledge the AV detections as legit and may put them into the allowlist for the AV.

You should suspect that the infection is a worm or virus if one of the following is true:
  • the detection name contains "worm" or "virus"
  • the detected files are located on USB flash drives, external drives or your drive that is not the OS
  • the detected files are high in number (hundrets or more) and on files that are usually legit, e.g., belong to the operating system

Removing an infection:
For most malware it is enough to reinstall the OS.

If you know or suspect that your system was infected by a drive worm or virus (file infector), you will have to be very cautious and clean/wipe all attached drives as well as USB flash drives or external drives that were plugged in at the time of after time of infection. Worm infections can be cleaned by having an AV delete all worm related files.

After virus (file infector) infection it is recommended to not attempt to repair or fix infected files but wipe everything. Files with an attached virus cannot be turned back to the way they were. Some information in them gets destroyed. Tools that repair those files often leave in some traces of the virus and cause AV software to still detect those files as malicious.

Mitigation:
Use an external drive for making backups that is not plugged in all the time. This will prevent the spread of an infection to the drive. It also helps in case of ransomware infection that the ransomware cannot access the backup drive at the time of encryption.
 
Last edited:

koloveli

Level 2
the more problem are trojancrypt (encrypt datas in devices internal or external);
drives usb external should not connected all time in PC, but only when save files (note: with system clean and not infected)
 

MegenM

Level 2
My concern is that if you're able to disinfect the new drive, couldn't you be able to disinfect the old drive without formatting? Furthermore, if it's not possible, isn't it possible that the new drive cannot be completely disinfected even if you think you did?

I was able to completely disinfect the old drive. However, I had moved data to new SSD as I wanted to perform an upgrade.
 
Top