Boot sector virus/external USB devices

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by herr5407, Oct 11, 2006.

  1. herr5407

    herr5407 Private E-2

    Hello everyone.

    Recently I have removed a boot sector virus on both computers in my network (yes, both of them. It was not fun) and just before I had diagnosed it as a boot sector virus, I noticed that my external hard drive was acting very erratic. Now that both computers are clean, would it be safe to plug in my external USB drive/flash stick?

    I would think that the drives don't have a boot sector and could not be infected but I just want to know some other opinions before I possibly plunge myself into writing 0s for hours.

    I currently have 2 virus scanners running. AntiVir and AVG free (yeah both freebies). Any suggestions or should I just plug er it and see what does down? (hopefully not the computer) I got 2 years of data on this drive. arggg
     
  2. herr5407

    herr5407 Private E-2

    Sorry I did not read the post that said read this first.... I will use Antivir only. Sorry...
     
  3. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    If you have truly removed the boot sector virus, then you should not have any problems.

    I do believe that USB drives can be made to be bootable. Whether there is a Master Boot Record there by default, I don't know. I personally have no experience in doing this. That would be a question better asked in the Hardware Forum. But here is an article that discusses making a bootable USB drive (I sure there are more).

    http://gentoo-wiki.com/HOWTO_Create_a_DOS_boot_USB_flash_drive
     
  4. herr5407

    herr5407 Private E-2

    I can garantee that removal has been successful on all machines that were originally infected. I decided to plug it in and see what happened anyways.

    Basically it didn't go well.

    USB drive is detected, OS installs the drivers. The drive isn't being shown in my computer. I then rebooted the computer and it went completely nuts.

    wrote 0s, ripped out memory, re-installed. back to square one.

    I might try and plug it into a mac. Dont even know if they use the same type of boot sector system.

    Thanks for the advice though. This problem is a very annoying one
     
  5. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Hmmm! Sounds like the USB drive infected your PC! So the USB drive must have been physically plugged into one of your systems while they were infected and it spread the boot sector virus to the USB device.
     
  6. herr5407

    herr5407 Private E-2

    Yup. You hit it right on the head there.

    This is what I was thinking....

    I would open up the tower and unplug the hard drive and boot off of a linux or windows live CD or something (anything write protected) and then wipe the drive. I need something that can write 0s to the drive though to compeltely erraticate it. hmmmm.

    Slowly working this mofo out. It's a nasty one.
     
  7. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Writing 0 to the data part of the partition will not remove the boot sector information. You have to erase the partition, repartition, and format. I'm not sure how this is done on a USB drive. You may want to ask about this in the Hardware Forum.
     
  8. herr5407

    herr5407 Private E-2

    I was in the understanding that writing 0s destroyed all data on the drive including the boot sector and parition table. If this wasn't true, then the virus would have come back on the PCs that I attempted to remove, which didn't happen.

    Writing 0s is considered a mid-level format, which is basically the way the drive comes out of the factory.

    Single pass zeros took care of the problem on my PCs. I'm just waiting to get some school work done so I can save and then try some other things.
     
  9. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Yes that is true but what I said was:
    When I said "data part of the partition" I was referring to the file space not the lower level partition information.
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds