Re: transferring files from infected drive.


"Joseph O'Brien" <obrien1984@xxxxxxxxxxx> wrote in message
news:1185894430.142692.256190@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hello, everyone. I have a computer that has been infected with a virus/
worm/trojan/whatever. I'm not completely sure which one, but my
computer does the automatic shutdown thing (initiated by NT Authority
\System).

I think I have the virus cleaned off, but the OS has been damaged. Can
someone who knows advise me on the plan below?

1) Remove suspect drive from PC. Replace with a new, store-bought
drive.
2) Install clean OS, updates programs, virus scan, etc.
3) Re-attach suspect drive as slave.
4) Copy necessary files over from suspect drive, leaving out Program
Files and anything in ~\Local Settings.

I do have backups, but they are most likely infected as well. I was
thinking that it might be easier to just pull the files directly off
the suspect drive, rather than transfer them to an external drive.
However, I want to be sure that whatever was on the suspect drive
doesn't "jump ship" to the good drive. I assume that, as long as the
MBR of the new drive is clean, and as long as I don't open an
executable that contains the virus, then I should be OK.

Is this a correct assumption?

Thanks.
Joseph


There is not much I can add to the replies you received
from the other respondents but I wonder what's happened
to the noble art of backing up important files at regular
intervals, eg. once a week? Next time you might not be
so lucky - your disk might become unreadable.


.

Relevant Pages

  • transferring files from infected drive.
    ... computer does the automatic shutdown thing (initiated by NT Authority ... I think I have the virus cleaned off, but the OS has been damaged. ... Install clean OS, updates programs, virus scan, etc. ...
    (microsoft.public.windowsxp.general)
  • Re: transferring files from infected drive.
    ... computer does the automatic shutdown thing (initiated by NT Authority ... I think I have the virus cleaned off, but the OS has been damaged. ... Install clean OS, updates programs, virus scan, etc. ...
    (microsoft.public.windowsxp.general)
  • Re: New Laptop
    ... More then likely it an effect of a recent virus (Blaster I think). ... down/restart with "Remote Procedure Call" or "N T Authority". ... understand what this is and how to control it ...
    (microsoft.public.sms.admin)